Strang log Authentication ? Need Help

NeoNico · 12. April 2015

What does that mean ?

Code

Apr 12 07:35:13 OMV sshd[17389]: Failed password for root from 43.255.190.140 port 53756 ssh2
Apr 12 07:35:14 OMV sshd[17391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.191.144  user=root
Apr 12 07:35:15 OMV sshd[17389]: Failed password for root from 43.255.190.140 port 53756 ssh2
Apr 12 07:35:15 OMV sshd[17391]: Failed password for root from 43.255.191.144 port 50033 ssh2
Apr 12 07:35:17 OMV sshd[17389]: Failed password for root from 43.255.190.140 port 53756 ssh2
Apr 12 07:35:17 OMV sshd[17389]: Received disconnect from 43.255.190.140: 11:  [preauth]
Apr 12 07:35:17 OMV sshd[17389]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.140  user=root
Apr 12 07:35:18 OMV sshd[17391]: Failed password for root from 43.255.191.144 port 50033 ssh2
Apr 12 07:35:21 OMV sshd[17391]: Failed password for root from 43.255.191.144 port 50033 ssh2
Apr 12 07:35:21 OMV sshd[17391]: Received disconnect from 43.255.191.144: 11:  [preauth]
Apr 12 07:35:21 OMV sshd[17391]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.191.144  user=root
Apr 12 07:35:24 OMV sshd[17496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.140  user=root
Apr 12 07:35:26 OMV sshd[17496]: Failed password for root from 43.255.190.140 port 56719 ssh2
Apr 12 07:35:27 OMV sshd[17496]: Failed password for root from 43.255.190.140 port 56719 ssh2
Apr 12 07:35:27 OMV sshd[17498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.191.144  user=root
Apr 12 07:35:30 OMV sshd[17498]: Failed password for root from 43.255.191.144 port 52392 ssh2
Apr 12 07:35:30 OMV sshd[17496]: Failed password for root from 43.255.190.140 port 56719 ssh2
Apr 12 07:35:30 OMV sshd[17496]: Received disconnect from 43.255.190.140: 11:  [preauth]
...
...
Apr 12 19:36:29 OMV sshd[4826]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:36:35 OMV sshd[4831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:36:37 OMV sshd[4831]: Failed password for root from 43.255.190.134 port 53862 ssh2
Apr 12 19:36:38 OMV sshd[4831]: Failed password for root from 43.255.190.134 port 53862 ssh2
Apr 12 19:36:41 OMV sshd[4831]: Failed password for root from 43.255.190.134 port 53862 ssh2
Apr 12 19:36:41 OMV sshd[4831]: Received disconnect from 43.255.190.134: 11:  [preauth]
Apr 12 19:36:41 OMV sshd[4831]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:36:47 OMV sshd[4835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:36:49 OMV sshd[4835]: Failed password for root from 43.255.190.134 port 57522 ssh2
Apr 12 19:36:51 OMV sshd[4835]: Failed password for root from 43.255.190.134 port 57522 ssh2
Apr 12 19:36:53 OMV sshd[4835]: Failed password for root from 43.255.190.134 port 57522 ssh2
Apr 12 19:36:53 OMV sshd[4835]: Received disconnect from 43.255.190.134: 11:  [preauth]
Apr 12 19:36:53 OMV sshd[4835]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:37:00 OMV sshd[4840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root
Apr 12 19:37:01 OMV sshd[4840]: Failed password for root from 43.255.190.134 port 60758 ssh2
Apr 12 19:37:03 OMV sshd[4840]: Failed password for root from 43.255.190.134 port 60758 ssh2
Apr 12 19:37:05 OMV sshd[4840]: Failed password for root from 43.255.190.134 port 60758 ssh2
Apr 12 19:37:06 OMV sshd[4840]: Received disconnect from 43.255.190.134: 11:  [preauth]
Apr 12 19:37:06 OMV sshd[4840]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.255.190.134  user=root

Alles anzeigen

I need some help

Thank's

tekkb · 12. April 2015

Some bot trying to login on your system from Hong Kong.

If you are going to open up SSH to the internet you should do this:

[GUIDE] Enable SSH with Public Key Authentication (Securing remote webUI access to OMV)

or use one of the VPN plugins and don't open up SSH to the internet. With the VPN plugins you can safely connect to your LAN and once connected use SSH.

NeoNico · 13. April 2015

Thank's for response,

I'm reading the guide.
It's possible for external user change the password of WebUI. Yesterday I didn't connect to WebUI. Now i have change the password for WebUI and Root for more security.
And for more security i have restart my "Net Box Operator" for change IP ( i think) and shuntdown OMV at this time.

Can you said me the difference between SSH and VPN ? Or it was complementary ?

Thank's,
Nico

EDIT :

I see fail2ban, it will be a good alternative ?

davidh2k · 14. April 2015

Zitat von NeoNico

difference between SSH and VPN

SSH is an encrypted command line interface connection. OpenVPN connects to the target host and allows you to interact with the remote network, if enabled. It's like you're in the remote network.

Greetings
David

Jetzt mitmachen!