log di ssh

[nik600]

ciao

dove trovo un log completo di quello che succede con ssh?

è stato fatto un bruteforce sul mio server:

Sep 14 19:49:00 unixweb sshd[9740]: error: Could not get shadow information for NOUSER
Sep 14 19:49:04 unixweb sshd[9744]: error: Could not get shadow information for NOUSER
Sep 14 19:49:07 unixweb sshd[9748]: error: Could not get shadow information for NOUSER
Sep 14 19:49:10 unixweb sshd[9752]: error: Could not get shadow information for NOUSER
Sep 14 19:49:14 unixweb sshd[9756]: error: Could not get shadow information for NOUSER
Sep 14 19:49:18 unixweb sshd[9760]: error: Could not get shadow information for NOUSER
Sep 14 19:49:21 unixweb sshd[9764]: error: Could not get shadow information for NOUSER
Sep 14 19:49:24 unixweb sshd[9768]: error: Could not get shadow information for NOUSER
Sep 14 19:49:28 unixweb sshd[9772]: error: Could not get shadow information for NOUSER
Sep 14 19:49:31 unixweb sshd[9776]: error: Could not get shadow information for NOUSER
Sep 14 19:49:34 unixweb sshd[9780]: error: Could not get shadow information for NOUSER
Sep 14 19:49:37 unixweb sshd[9784]: error: Could not get shadow information for NOUSER
Sep 14 19:49:41 unixweb sshd[9788]: error: Could not get shadow information for NOUSER
Sep 14 19:49:44 unixweb sshd[9792]: error: Could not get shadow information for NOUSER
Sep 14 19:49:47 unixweb sshd[9796]: error: Could not get shadow information for NOUSER
Sep 14 19:49:51 unixweb sshd[9800]: error: Could not get shadow information for NOUSER
Sep 14 19:49:54 unixweb sshd[9804]: error: Could not get shadow information for NOUSER
Sep 14 19:49:57 unixweb sshd[9808]: error: Could not get shadow information for NOUSER
Sep 14 19:50:00 unixweb sshd[9812]: error: Could not get shadow information for NOUSER
Sep 14 19:50:04 unixweb sshd[9816]: error: Could not get shadow information for NOUSER
Sep 14 19:50:07 unixweb sshd[9820]: error: Could not get shadow information for NOUSER
Sep 14 19:50:10 unixweb sshd[9824]: error: Could not get shadow information for NOUSER
Sep 14 19:50:13 unixweb sshd[9828]: error: Could not get shadow information for NOUSER
Sep 14 19:50:17 unixweb sshd[9832]: error: Could not get shadow information for NOUSER
Sep 14 19:50:20 unixweb sshd[9836]: error: Could not get shadow information for NOUSER
Sep 14 19:50:23 unixweb sshd[9840]: error: Could not get shadow information for NOUSER
Sep 14 19:50:26 unixweb sshd[9844]: error: Could not get shadow information for NOUSER
Sep 14 19:50:30 unixweb sshd[9848]: error: Could not get shadow information for NOUSER
Sep 14 19:50:33 unixweb sshd[9852]: error: Could not get shadow information for NOUSER
Sep 14 19:50:36 unixweb sshd[9856]: error: Could not get shadow information for NOUSER
Sep 14 19:50:39 unixweb sshd[9860]: error: Could not get shadow information for NOUSER
Sep 14 19:50:43 unixweb sshd[9864]: error: Could not get shadow information for NOUSER
Sep 14 19:50:46 unixweb sshd[9868]: error: Could not get shadow information for NOUSER
Sep 14 19:50:49 unixweb sshd[9872]: error: Could not get shadow information for NOUSER
Sep 14 19:50:52 unixweb sshd[9876]: error: Could not get shadow information for NOUSER
Sep 16 10:45:45 unixweb sshd[20804]: error: Could not get shadow information for NOUSER
Sep 16 10:45:52 unixweb sshd[20814]: error: Could not get shadow information for NOUSER
Sep 16 10:45:58 unixweb sshd[20818]: error: Could not get shadow information for NOUSER
Sep 16 10:46:04 unixweb sshd[20822]: error: Could not get shadow information for NOUSER
Sep 16 10:46:11 unixweb sshd[20826]: error: Could not get shadow information for NOUSER
Sep 16 10:46:36 unixweb sshd[20845]: error: Could not get shadow information for NOUSER

vorrei vedere l'host che ha tentato gli accessi

[cacao74]

Guarda cosa è indicato in /etc/ssh/sshd_config

...
# Logging
SyslogFacility AUTH
LogLevel INFO
...

Poi vedi quali destinazioni sono impostate per questi messaggi in /etc/syslog.conf

ciao

[nik600]

ciao

quelle righe sono commentate

i log li ho trovati in /var/log/messages

dai log ho visto l'indirizzo che ha tentato il bruteforce , ho controllato con visualroute, appartiene ad una serie di indirizzi assegnati ad un provider USLEC Corp negli Stati Uniti.

secondo voi, cosa devo fare?

è molto probabile che chi ha tentato l'attacco sia passato da diversi proxy ...

mando una mail a abuse@uslec.com ? dove gli segnalo quello che è successo?

oppure dite che queste cose sono "normali" e devo lasciare perdere?

grazie mille

[Caleb]

/var/log/auth.log

non scomodarti a segnalare, sono normali

piuttosto, cambia la porta su cui sshd è in ascolto da 22 a un'altra bella alta e frenerai il 90% degli accessi

[nik600]

facendo così scp continua a funzionare?

dovrò passargli un'ulteriore parametro, giusto?

grazie

[Caleb]

per scp aggiungi -P porta