Forums | MacLife

Fatum · 2009-02-28 7:18 am

I have a server running from my desktop on 10.5.6. I have firewall turned on for blocking everything except for the applications that I authenticate and standard ports for SSH, FTP, File Sharing and Web Sharing. I run geektool which I have showing firewall log, ssh log, windowssharing log. This morning I woke up to messages everywhere saying "failed password attempt for invalid user root from 66.167.***.*** port 40581 ssh2" First off going for an unusual port and going for root access. I do not have root access enabled. My question is without it enabled it will just say invalid user the entire time correct? I should not enable it and create an extremely weird password for it since without that account either way they wouldn't be able to connect? Now if they had the admin account and got in that way they would be able to create a root user or at least use su root knowing the admin password. I already have a long complicated password for my admin account, have guest access turned off and no other accounts on the server. Is there anything else that I could be doing to deter someone trying to get in?

Update:

I did a little snooping and found that the IP originated from the San Jose, CA area. And looking through my logs more they had been attempting most of the night on different port numbers but always SSH protocol.

Last edited by Fatum (2009-02-28 7:49 am)

Fracai · 2009-02-28 8:31 am

Attempt? Yes. Success? No.
Changing to use non-standard ports would help, but I wouldn't say this is anything to worry about. Aside from it being a consistent attempt from the US. Most of my attacks come from Asia and went away when I changed my external ssh port. They'd also generally try standard or sequential usernames (user, a, aa, bbb, etc.). root came up rarely.

Fracai · 2009-02-28 8:34 am

Also, I'm pretty sure that the port number is the randomly generated originating port number on their end. Unless you really do have ssh running on multiple ports. Which I think is unlikely.

Fatum · 2009-02-28 10:20 pm

For some reason I have been getting bombarded on attempts in the past day. Also had connection attempts from Amsterdam, Japan and Indonesia. I have done some changes to my set-up to seal it up more. Each connection attempt will only except two password tries then disconnects and the IP address only gets two connection attempts (4 tries at the password) then it gets blacklisted for 10 days from connecting at all. Anything else I could do? Already have SSH on a non-standard port

Fatum · 2009-03-02 9:15 pm

I've been trying to figure out how to do it so now I ask here. With the attempts that have been going on the secure.log shows what names they are trying to use but I'm wondering if there is a way I can capture the passwords that they are trying?

Forums | MacLife

#1 2009-02-28 7:18 am

Hacking attempted???

#2 2009-02-28 8:31 am

Re: Hacking attempted???

#3 2009-02-28 8:34 am

Re: Hacking attempted???

#4 2009-02-28 10:20 pm

Re: Hacking attempted???

#5 2009-03-02 9:15 pm

Re: Hacking attempted???

Board footer