SSH attacks drain 4GB in 10 hours. Possible?

Question

I have been warned that my server broke its transfer limit. I thougt that my Tor node became popular so I chose to disable it this month (not the best choice for the community but I need to go down). Then I noticed that the server transferred around 4GBs this night. I have checked Apache logs with Awstats, no relevant traffic (and I don't host so popular sites there). I have checked mail logs, no one tried to send garbage. I have checked messages logs and found tons of these

Apr 29 10:17:53 marcus sshd[9281]: Did not receive identification string from 85.170.189.156
Apr 29 10:18:07 marcus sshd[9283]: Did not receive identification string from 86.208.123.132
Apr 29 10:18:24 marcus sshd[9298]: Did not receive identification string from 85.170.189.156
Apr 29 10:18:39 marcus sshd[9303]: Did not receive identification string from 86.208.123.132
Apr 29 10:18:56 marcus sshd[9306]: Did not receive identification string from 85.170.189.156
Apr 29 10:19:11 marcus sshd[9309]: Did not receive identification string from 86.208.123.132
Apr 29 10:19:18 marcus sshd[9312]: Did not receive identification string from 101.98.178.92
Apr 29 10:19:27 marcus sshd[9314]: Did not receive identification string from 85.170.189.156
Apr 29 10:19:41 marcus sshd[9317]: Did not receive identification string from 86.208.123.132
Apr 29 10:20:01 marcus sshd[9321]: Did not receive identification string from 85.170.189.156
Apr 29 10:20:13 marcus sshd[9324]: Did not receive identification string from 86.208.123.132
Apr 29 10:20:32 marcus sshd[9327]: Did not receive identification string from 85.170.189.156
Apr 29 10:20:48 marcus sshd[9331]: Did not receive identification string from 86.208.123.132
Apr 29 10:21:07 marcus sshd[9336]: Did not receive identification string from 85.170.189.156
Apr 29 10:21:20 marcus sshd[9338]: Did not receive identification string from 86.208.123.132
Apr 29 10:21:35 marcus sshd[9341]: Did not receive identification string from 85.170.189.156
Apr 29 10:21:51 marcus sshd[9344]: Did not receive identification string from 86.208.123.132
Apr 29 10:22:06 marcus sshd[9349]: Did not receive identification string from 85.170.189.156
Apr 29 10:22:23 marcus sshd[9353]: Did not receive identification string from 86.208.123.132
Apr 29 10:22:39 marcus sshd[9359]: Did not receive identification string from 85.170.189.156
Apr 29 10:22:54 marcus sshd[9361]: Did not receive identification string from 86.208.123.132
Apr 29 10:23:10 marcus sshd[9367]: Did not receive identification string from 85.170.189.156
Apr 29 10:23:29 marcus sshd[9369]: Did not receive identification string from 86.208.123.132
Apr 29 10:23:45 marcus sshd[9375]: Did not receive identification string from 85.170.189.156
Apr 29 10:24:10 marcus sshd[9387]: Did not receive identification string from 86.208.123.132
Apr 29 10:24:16 marcus sshd[9388]: Did not receive identification string from 85.170.189.156

Every few seconds a bot is trying to hack my SSH, which is impossible because I require pubkey authentication. My question is: can this traffic, at this frequency, consume 4GBs (let's say 3.5) in 10 hours of continuous attack?

I have changed my SSH port and stopped these attacks, but I'm unsure about my network consumption. I don't have services out of control running -my firewall is kinda restrictive-, or share the server with someone abusively doing P2P or whatever. My concern is to go below 400GB/month.

Any tips?

Lucas Kauffman · Accepted Answer · 2012-04-29T15:42:01.200

16

4 GB is possible, but very unlikely considering the attack rate. I suggest installing OSSEC, it detects break in attempts and blocks the IP automatically for a certain time out.

edited Apr 29 '12 at 15:42

answered Apr 29 '12 at 08:51

Lucas Kauffman

16,818
9
57
92

1

I already have fail2ban, it successfully blocked bad logins but seems to ignore these messages. Maybe I'll tune it up. – usr-local-ΕΨΗΕΛΩΝ Apr 29 '12 at 08:59
1

Accepted. Fail2ban needed some tuning to accept that log messages as break-in attempts. +1 to @lain too because I can't accept 2 answers – usr-local-ΕΨΗΕΛΩΝ Apr 29 '12 at 13:48
@djechelon: Please let us know f this does solve the problem. Somehow I doubt that it will as the packets are dropped after arriving at your system. – user9517 Apr 29 '12 at 15:05
@Iain most attackers give up when they're getting dropped. – Lucas Kauffman Apr 29 '12 at 15:09
3

@LucasKaufman: 4Gb/10Hrs is ~120Kb/sec. I don't see there being that much throughput from failed attempts and the snippet above show a much lower attack rate (26 in ~7 mins). – user9517 Apr 29 '12 at 15:38
60 kb/sec if you consider the response. But you're right, it was just an idea. – Lucas Kauffman Apr 29 '12 at 15:41
I reconfigured fail2ban enabling ssh-ddos rule, now it blocks these scanners and traffic immediately stopped increasing – usr-local-ΕΨΗΕΛΩΝ Apr 30 '12 at 10:44
hurray ^^ glad I could help :) – Lucas Kauffman Apr 30 '12 at 11:08

score 14 · Answer 2 · edited Feb 07 '13 at 16:14

14

If these are the cause of the bandwidth usage then the bandwidth is already consumed by the time you deal with them on your system. You can use a tool like iptraf to give you a breakdown of what's happening on each interface/port and then you can take appropriate action based on facts.

edited Feb 07 '13 at 16:14

Antoine Benkemoun

7,314
3
41
60

answered Apr 29 '12 at 09:16

user9517

114,104
20
206
289

Obviously I can put my efforts on preventing future consumption of bandwidth, starting from the upcoming month – usr-local-ΕΨΗΕΛΩΝ Apr 29 '12 at 09:46
1

And... very helpful answer, but iptraf doesn't work with OpenVZ (reference https://www.webhostingtalk.com/showthread.php?t=924814) and I didn't mention it :) – usr-local-ΕΨΗΕΛΩΝ Apr 29 '12 at 09:52
The basic idea remains the same. Find something that will tell you where the usage is and then solve the problem. Anything else is guesswork. – user9517 Apr 29 '12 at 11:00

score 4 · Answer 3 · answered Apr 29 '12 at 15:02

4

No, these once-per second connection attempts themselves are not going to add up to 4GB in ten hours. Do you think you could download a 4GB file in 10 hours by getting getting a tiny packet once a second? There are 3600 seconds in an hour, so if you get a kilobyte a second for ten hours, that would be 36000 Kb, or 36 megabytes.

Your bandwidth is measured according to what goes down the pipe from your provider to your external router, not what reaches your server. You have to look at the crap that isn't reaching your server, that most external piece of equipment is rejecting.

As far as what does reach your server, you cannot rely on application logs. Even packets that are silently dropped by the local firewall are bandwidth. Interface stats (shown by ifconfig) will tell you Tx/Rx bytes.

answered Apr 29 '12 at 15:02

Kaz

487
2
11

Not sure. From my point of view, log messages show that clients opened a socket to port 22 but were rejected because "what they transmitted" was not recognized as proper SSH handshake. I didn't want to wiretap port 22 to see the actual payload that the scanners sent, but in theory they could send tons of garbage until SSH drops. The question is: when does openSSH drops an invalid handshake? Second, I spent a night with Tor disabled and traffic still increased (Apache didn't show significative traffic), when reconfigured fail2ban traffic almost stopped – usr-local-ΕΨΗΕΛΩΝ Apr 30 '12 at 10:43
1

Let me rephrase a bit, just in case. If I wanted to drain 4GBs of bandwidth from a server I could make a botnet that opens HTTP connections and sends unlimited POST payloads for each request. Logs will show that failed requests occur with low rates, but each is extremely heavy. But this starts to lose sense. I have been familiar with SSH scans ("failed authentication for root, admin...") because their objective is to take control of the node. Why an attacker would mind draining bandwidth via SSH? Doesn't make sense. Unless someone hates Tor nodes... – usr-local-ΕΨΗΕΛΩΝ Apr 30 '12 at 10:53

SSH attacks drain 4GB in 10 hours. Possible?

3 Answers3