Inetone: VServer Brute Force Attacks

Block brute force SSH login tries#

If you see similar entries in /var/log/auth.log

Dec 27 10:35:10 euve2798 sshd[11306]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:10 euve2798 sshd[11306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:12 euve2798 sshd[11306]: Failed password for root from 110.76.47.211 port 55947 ssh2
Dec 27 10:35:16 euve2798 sshd[11308]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:16 euve2798 sshd[11308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:18 euve2798 sshd[11308]: Failed password for root from 110.76.47.211 port 56114 ssh2
Dec 27 10:35:20 euve2798 sshd[11310]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:20 euve2798 sshd[11310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:22 euve2798 sshd[11310]: Failed password for root from 110.76.47.211 port 56309 ssh2
Dec 27 10:35:25 euve2798 sshd[11312]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:25 euve2798 sshd[11312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:27 euve2798 sshd[11312]: Failed password for root from 110.76.47.211 port 56488 ssh2
Dec 27 10:35:30 euve2798 sshd[11314]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:30 euve2798 sshd[11314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:32 euve2798 sshd[11314]: Failed password for root from 110.76.47.211 port 56645 ssh2
Dec 27 10:35:35 euve2798 sshd[11316]: reverse mapping checking getaddrinfo for unknown-110-76-47-211.aliyun.com [110.76.47.211] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 27 10:35:35 euve2798 sshd[11316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.76.47.211  user=root
Dec 27 10:35:38 euve2798 sshd[11316]: Failed password for root from 110.76.47.211 port 56844 ssh2

Use

> iptables

see here

Block IP address:

iptables -I INPUT -s 46.218.179.49 -j DROP
iptables -I INPUT -s 1.93.29.42 -j DROP
iptables -I INPUT -s 189.194.44.146 -j DROP
iptables -I INPUT -s 213.251.176.115 -j DROP
iptables -I INPUT -s 64.109.62.185 -j DROP
iptables -I INPUT -s 222.141.201.2 -j DROP
iptables -I INPUT -s 89.248.172.58 -j DROP
iptables -I INPUT -s 61.160.215.218 -j DROP
iptables -I INPUT -s 218.2.22.116 -j DROP
iptables -I INPUT -s 61.160.215.211 -j DROP
iptables -I INPUT -s 213.74.204.82 -j DROP
iptables -I INPUT -s 61.160.213.152 -j DROP
iptables -I INPUT -s 46.105.109.70 -j DROP
iptables -I INPUT -s 60.10.203.18 -j DROP

Check all rules

iptables -L -v