I don't usually check my auth log, but last night I did and I had apparently been targeted by someone in china. So modified my iptables to block him and upgrade a few things security wise and all was fine again. But around 8pm today I stared get hit from someone in Turkey, every few seconds (example in the code box).They're not getting through, but really trying. I even decided to just close all my ports even (now I can't even SSH outside my house lol. I'm just curious if this is normal, or if I should contact my provider (Comcast) and tell them there is malicious attacks against my IP and hope they give me a new IP (it hasn't changed in 2 years).
Code
Jun 1 21:12:07 omvnas sshd[27477]: Invalid user test from 195.244.40.183
Jun 1 21:12:07 omvnas sshd[27477]: input_userauth_request: invalid user test [preauth]
Jun 1 21:12:07 omvnas sshd[27477]: Received disconnect from 195.244.40.183: 11: Bye Bye [preauth]
Jun 1 21:12:09 omvnas sshd[27479]: Address 195.244.40.183 maps to ip.semele.com.tr, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jun 1 21:12:09 omvnas sshd[27479]: Invalid user test from 195.244.40.183
Jun 1 21:12:09 omvnas sshd[27479]: input_userauth_request: invalid user test [preauth]
Jun 1 21:12:10 omvnas sshd[27479]: Received disconnect from 195.244.40.183: 11: Bye Bye [preauth]
Jun 1 21:12:11 omvnas sshd[27482]: Address 195.244.40.183 maps to ip.semele.com.tr, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jun 1 21:12:11 omvnas sshd[27482]: Invalid user test from 195.244.40.183
Jun 1 21:12:11 omvnas sshd[27482]: input_userauth_request: invalid user test [preauth]
Jun 1 21:12:12 omvnas sshd[27482]: Received disconnect from 195.244.40.183: 11: Bye Bye [preauth]
Jun 1 21:12:13 omvnas sshd[27484]: Address 195.244.40.183 maps to ip.semele.com.tr, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jun 1 21:12:13 omvnas sshd[27484]: Invalid user test from 195.244.40.183
Jun 1 21:12:13 omvnas sshd[27484]: input_userauth_request: invalid user test [preauth]
Jun 1 21:12:14 omvnas sshd[27484]: Received disconnect from 195.244.40.183: 11: Bye Bye [preauth]
Alles anzeigen