Ho 3 server CentOS configurati per le mie applicazioni. Recentemente ho riconosciuto che ci sono così tanti attacchi ai miei server. Ho così tanti registri sul tentativo di accedere ai miei server usando sshd da IP sconosciuti.
Questa è una parte del mio registro sicuro:
May 25 03:45:03 mail sshd[22291]: Invalid user user from 42.121.117.150
May 25 03:45:03 mail sshd[22303]: input_userauth_request: invalid user user
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:03 mail sshd[22291]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:05 mail sshd[22291]: Failed password for invalid user user from 42.121.117.150 port 59430 ssh2
May 25 03:45:05 mail sshd[22303]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:07 mail sshd[22563]: Invalid user user from 42.121.117.150
May 25 03:45:07 mail sshd[22564]: input_userauth_request: invalid user user
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:07 mail sshd[22563]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:09 mail sshd[22563]: Failed password for invalid user user from 42.121.117.150 port 59655 ssh2
May 25 03:45:09 mail sshd[22564]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:11 mail sshd[22565]: Invalid user user1 from 42.121.117.150
May 25 03:45:11 mail sshd[22566]: input_userauth_request: invalid user user1
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:11 mail sshd[22565]: pam_succeed_if(sshd:auth): error retrieving information about user user1
May 25 03:45:13 mail sshd[22565]: Failed password for invalid user user1 from 42.121.117.150 port 59861 ssh2
May 25 03:45:13 mail sshd[22566]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:15 mail sshd[22570]: Invalid user user from 42.121.117.150
May 25 03:45:15 mail sshd[22571]: input_userauth_request: invalid user user
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:15 mail sshd[22570]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:17 mail sshd[22570]: Failed password for invalid user user from 42.121.117.150 port 60107 ssh2
...
May 30 05:28:20 mail sshd[29998]: Failed password for root from 219.138.135.68 port 45105 ssh2
May 30 05:28:21 mail sshd[30273]: Failed password for root from 219.138.135.68 port 53227 ssh2
May 30 05:28:21 mail sshd[30266]: Failed password for root from 219.138.135.68 port 51786 ssh2
May 30 05:28:21 mail unix_chkpwd[30296]: password check failed for user (root)
May 30 05:28:21 mail unix_chkpwd[30297]: password check failed for user (root)
May 30 05:28:21 mail sshd[30280]: Failed password for root from 219.138.135.68 port 55313 ssh2
May 30 05:28:22 mail unix_chkpwd[30298]: password check failed for user (root)
...
May 31 11:12:38 mail sshd[2461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:40 mail sshd[2461]: Failed password for root from 211.233.60.37 port 48375 ssh2
May 31 11:12:40 mail sshd[2462]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:45 mail unix_chkpwd[2671]: password check failed for user (root)
May 31 11:12:45 mail sshd[2669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:47 mail sshd[2669]: Failed password for root from 211.233.60.37 port 48619 ssh2
May 31 11:12:47 mail sshd[2670]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:50 mail unix_chkpwd[2675]: password check failed for user (root)
May 31 11:12:50 mail sshd[2673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:52 mail sshd[2673]: Failed password for root from 211.233.60.37 port 48905 ssh2
May 31 11:12:53 mail sshd[2674]: Received disconnect from 211.233.60.37: 11: Bye Bye
...
Come posso bloccare questo tipo di attacchi al mio server? Ho installato iptables sul mio server e tutte le porte (tranne le mie esigenze) sono state rifiutate al suo interno.