0

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu machine). Fail2ban is blocking these IPs but I do not understand how they are coming to my VM.

What can be happening?

PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.7  user=root
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.18.238.7 

Failed password for root from 121.18.238.7 port 60579 ssh2
message repeated 2 times: [ Failed password for root from 121.18.238.7 port 60579 ssh2]
techraf
  • 9,141
  • 11
  • 44
  • 62
jdmorei
  • 21
  • 4
  • 1
    Just on a quick side note. SSH should be running its privileged port 22. Changing the port reduces the amount of log entries, but is more dangerous. Here's a full article explaining it: https://www.adayinthelifeof.nl/2012/03/12/why-putting-ssh-on-another-port-than-22-is-bad-idea/ – Potaito Jul 07 '16 at 16:08
  • @potAito I disagree. if you are using SSH keys (which you should be using anyway) this attack will have no effect since there is no password to steal. – André Borie Aug 06 '16 at 16:07
  • Are you sure you have a network security group set up with rules to block inbound ssh and that network security group is assigned to your vm? On the nsg resource you can click "effective security rules" to check the ruleset, and on your vm network settings you can check the assigned nsg. And I just realized this is a months old question. Will still leave my comment here. :) – Gabor Lengyel Dec 05 '16 at 00:28
  • @GaborLengyel Thank you for your answer, since a few months ago robots are not getting to my VM's and I didn't changed security configurations in Azure. – jdmorei Jan 13 '17 at 12:08

1 Answers1

1

No need to worry, these are just typical attempts to find vulnerable servers. You've Fail2Ban already installed, this way you decrease the brute force attempts.

mike-stokkel
  • 189
  • 4