Today (Saturday), I booted up only once, logged in only once as my primary common user,
and then a short while ago logged in to an different account with adequate privileges to
view the journalctl. With over 12 hours as a common user, I hoped that searching the
journalctl would be simpler. I hoped!
In today's log, there were at least 148 occurrences of "authentication
failure", 41 occurrences of "password check failed", 14 occurrences of
"user=root", 27 occurrences of "user (root)", 270 occurrences of
"invalid user", 1546 occurrences of "CRYPTO_KEY_USER", and 296
occurrences of "CRYPTO_SESSION". I saw the following "rhost=" ip
addresses:
62.176.5.7
36.250.77.36
5.196.67.128
91.232.157.98
5.101.40.10
91.197.232.103
I saw the following "user=" fields:
root
operator
ftp
mysql
games
I saw the following "invalid user ______ " fields, most followed by
"[preauth]":
share
user
docker
vsftpd
arma3server
nagios
PlcmSpIp
samba
cs
csgoserver
ftpuser
osama
admin
monte
pi
monitor
debian
guest
ubnt
osmc
odroid
mobile
ts
steam
0
0000
010101
1111
1234
api
dbadmin
mc
default
git
gpadmin
service
support
sysadmin
telecomadmin
telnet
test
ubnt
user
user1
jboss
Can y0u show us the full text of some representative messages
(perhaps
replacing any IP addresses with placeholders for privacy purposes)?
Here are a few relevant journalctl entries:
Jul 01 11:49:52 xxxxxxxxxx audit[10407]: USER_AUTH pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:49:52 xxxxxxxxxx unix_chkpwd[10411]: password check failed for user (root)
Jul 01 11:49:52 xxxxxxxxxx sshd[10407]: pam_succeed_if(sshd:auth): requirement "uid
>= 1000" not met by user "root"
Jul 01 11:49:52 xxxxxxxxxx audit[10407]: USER_AUTH pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication
grantors=? acct="root" exe="/usr/sbin/sshd" hostname=36.250.77.36
addr=36.250.77.36 terminal=ssh res=failed'
Jul 01 11:49:54 xxxxxxxxxx sshd[10407]: Failed password for root from 36.250.77.36 port
51702 ssh2
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: USER_AUTH pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:49:54 xxxxxxxxxx sshd[10407]: Connection closed by 36.250.77.36 port 51702
[preauth]
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:03:65:34:22:92:2c:17:22:fc:8a:b6:b5:e7:f3:ec:50:c3:62:42:73:ac:a9:70:34:88:dc:7d:a9:89:3f:5c:e9
direction=? spid=10408 suid=74 exe="/usr/sbin/sshd" hostname=? addr=?
terminal=? res=success'
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=session fp=? direction=both spid=10408 suid=74 rport=51702 laddr=xxxxxxxxxxxxxx
lport=xx exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36 terminal=?
res=success'
Jul 01 11:49:54 xxxxxxxxxx sshd[10407]: PAM 2 more authentication failures; logname= uid=0
euid=0 tty=ssh ruser= rhost=36.250.77.36 user=root
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:82:79:d0:65:d5:4a:2b:06:07:dd:ad:07:28:cc:a6:a0:e3:12:12:6a:f1:ae:64:91:d2:b1:68:42:55:f7:77:38
direction=? spid=10407 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:c7:c1:32:3a:be:0f:e3:c2:4a:f3:d3:5b:46:f8:38:93:6a:b7:e1:6b:e4:a0:72:e8:ea:fd:63:89:31:5b:d4:87
direction=? spid=10407 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:77:7e:93:19:a5:60:e0:fa:79:bd:e7:85:ad:e0:b5:8c:b3:fe:6d:9b:e1:a8:9b:a7:45:68:ef:76:dd:a7:f4:f2
direction=? spid=10407 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: CRYPTO_KEY_USER pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:03:65:34:22:92:2c:17:22:fc:8a:b6:b5:e7:f3:ec:50:c3:62:42:73:ac:a9:70:34:88:dc:7d:a9:89:3f:5c:e9
direction=? spid=10407 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:54 xxxxxxxxxx audit[10407]: USER_LOGIN pid=10407 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:49:55 xxxxxxxxxx audit[10413]: CRYPTO_KEY_USER pid=10413 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:82:79:d0:65:d5:4a:2b:06:07:dd:ad:07:28:cc:a6:a0:e3:12:12:6a:f1:ae:64:91:d2:b1:68:42:55:f7:77:38
direction=? spid=10413 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:55 xxxxxxxxxx audit[10413]: CRYPTO_KEY_USER pid=10413 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:c7:c1:32:3a:be:0f:e3:c2:4a:f3:d3:5b:46:f8:38:93:6a:b7:e1:6b:e4:a0:72:e8:ea:fd:63:89:31:5b:d4:87
direction=? spid=10413 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:55 xxxxxxxxxx audit[10413]: CRYPTO_KEY_USER pid=10413 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:77:7e:93:19:a5:60:e0:fa:79:bd:e7:85:ad:e0:b5:8c:b3:fe:6d:9b:e1:a8:9b:a7:45:68:ef:76:dd:a7:f4:f2
direction=? spid=10413 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:55 xxxxxxxxxx audit[10413]: CRYPTO_KEY_USER pid=10413 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:03:65:34:22:92:2c:17:22:fc:8a:b6:b5:e7:f3:ec:50:c3:62:42:73:ac:a9:70:34:88:dc:7d:a9:89:3f:5c:e9
direction=? spid=10413 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=?
res=success'
Jul 01 11:49:55 xxxxxxxxxx audit[10412]: CRYPTO_SESSION pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start
direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-sha2-256
pfs=diffie-hellman-group-exchange-sha256 spid=10413 suid=74 rport=9224
laddr=xxxxxxxxxxxxxx lport=xx exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=? res=success'
Jul 01 11:49:55 xxxxxxxxxx audit[10412]: CRYPTO_SESSION pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start
direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-sha2-256
pfs=diffie-hellman-group-exchange-sha256 spid=10413 suid=74 rport=9224
laddr=xxxxxxxxxxxxxx lport=xx exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=? res=success'
Jul 01 11:49:57 xxxxxxxxxx unix_chkpwd[10414]: password check failed for user (root)
Jul 01 11:49:57 xxxxxxxxxx sshd[10412]: pam_unix(sshd:auth): authentication failure;
logname= uid=0 euid=0 tty=ssh ruser= rhost=36.250.77.36 user=root
Jul 01 11:49:57 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication
grantors=? acct="root" exe="/usr/sbin/sshd" hostname=36.250.77.36
addr=36.250.77.36 terminal=ssh res=failed'
Jul 01 11:49:57 xxxxxxxxxx sshd[10412]: pam_succeed_if(sshd:auth): requirement "uid
>= 1000" not met by user "root"
Jul 01 11:49:59 xxxxxxxxxx sshd[10412]: Failed password for root from 36.250.77.36 port
9224 ssh2
Jul 01 11:49:59 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:50:00 xxxxxxxxxx unix_chkpwd[10415]: password check failed for user (root)
Jul 01 11:50:00 xxxxxxxxxx sshd[10412]: pam_succeed_if(sshd:auth): requirement "uid
>= 1000" not met by user "root"
Jul 01 11:50:00 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication
grantors=? acct="root" exe="/usr/sbin/sshd" hostname=36.250.77.36
addr=36.250.77.36 terminal=ssh res=failed'
Jul 01 11:50:02 xxxxxxxxxx sshd[10412]: Failed password for root from 36.250.77.36 port
9224 ssh2
Jul 01 11:50:02 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:50:02 xxxxxxxxxx unix_chkpwd[10416]: password check failed for user (root)
Jul 01 11:50:02 xxxxxxxxxx sshd[10412]: pam_succeed_if(sshd:auth): requirement "uid
>= 1000" not met by user "root"
Jul 01 11:50:02 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication
grantors=? acct="root" exe="/usr/sbin/sshd" hostname=36.250.77.36
addr=36.250.77.36 terminal=ssh res=failed'
Jul 01 11:50:04 xxxxxxxxxx sshd[10412]: Failed password for root from 36.250.77.36 port
9224 ssh2
Jul 01 11:50:04 xxxxxxxxxx audit[10412]: USER_AUTH pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password
acct="root" exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36
terminal=ssh res=failed'
Jul 01 11:50:04 xxxxxxxxxx sshd[10412]: Connection closed by 36.250.77.36 port 9224
[preauth]
Jul 01 11:50:04 xxxxxxxxxx audit[10412]: CRYPTO_KEY_USER pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=server
fp=SHA256:03:65:34:22:92:2c:17:22:fc:8a:b6:b5:e7:f3:ec:50:c3:62:42:73:ac:a9:70:34:88:dc:7d:a9:89:3f:5c:e9
direction=? spid=10413 suid=74 exe="/usr/sbin/sshd" hostname=? addr=?
terminal=? res=success'
Jul 01 11:50:04 xxxxxxxxxx audit[10412]: CRYPTO_KEY_USER pid=10412 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy
kind=session fp=? direction=both spid=10413 suid=74 rport=9224 laddr=xxxxxxxxxxxxxx
lport=xx exe="/usr/sbin/sshd" hostname=? addr=36.250.77.36 terminal=?
res=success'
Jul 01 11:50:04 xxxxxxxxxx sshd[10412]: PAM 2 more authentication failures; logname= uid=0
euid=0 tty=ssh ruser= rhost=36.250.77.36 user=root
Anything else?
I did use the firewall configuration tool to turn off public ssh. We'll see what
difference that makes Monday. (I'll be out most of tomorrow.)
thanks,
Bill.