What's the best action to take?

[Red Squirrel]

I run a home server, mostly isolated network services, but a few external stuff forwarded by my router, such as ssh, which enables me to establish a ssh tunnel to access my home network.

Just out of boredom, I looked at the security logs and found TONS of invalid logon attempts from an IP address (222.122.56.141) which is in korea. Now I doubt they have laws against hacking, so contacting their abuse department probably wont do anything, and they probably wont understand my English though I could use an online translator...

My setup is secure, as far as I know. one single user is allowed to log in, and must then su as root. so he can brute force that all he wants but he wont get in even with a valid password.

So from a legal standpoint, as well as a security standpoint, what are the best things I can do right now? I'm not scared... yet, since a simple brute force wont get him in, but if I'm being targeted out of determination, for some reason or the other, it might grow to being a more sophisticated attack.

 

[Nothinman]

You're not being targetted, those brute-force scripts have been running for a few years now.

 

[Red Squirrel]

So I can just assume its a script? Can I still do anything legally, like some kind of place to report them or something? I cant see why I'd be targetted though so it probably is a script and I'm 1 of 1000000's of machines being hit.

 

[Nothinman]

You said yourself that you doubt the Korean government or their ISP will care and I would agree. I also really doubt your ISP or government would be willing to do anything either, but you can notify them if you want the worst that would happen is that they ignore you.

 

[n0cmonkey]

You could move the SSH port, create a script to block IPs with multiple failed login attempts, or shutdown SSH.

There are lots of bots out there trying to get more systems by brute forcing systems through SSH.

 

[cleverhandle]

Just typical mindless bot crap. Move the SSH port if you don't want the login failures cluttering your logs.

 

[Red Squirrel]

I closed it up for now, but yeah been wanting to figure out some kindof mechanism to auto block failed logins. I need to learn how to use iptables first. And I'll move the port since that will probably save against the bots at least.

Either way, all the failed attempts are as root so i'm not too woried, I'll get worried when I see the username that CAN login.

 

[skyking]

Moving the port ended all the failed login attempts on all my servers. Nobody goes wandering up in the higher thousands with port scans.