On Thu, 30 Jan 2020 at 17:13, Michael Eager <eager(a)eagercon.com> wrote:
When I look at /var/log/secure or run journalctl on my workstation,
see failed SSH login attempts from a variety of IP addresses. The
attempts are every 3-12 minutes.
The workstation is on a LAN behind an EdgeRouter firewall. No Internet-
accessible ports are forwarded to the workstation. The LAN has a
variety of servers, NAS boxes, WiFi access points, WiFi-connected
Do you manage the network so you can check things like the firewall's
version and have access to a list of mac addresses for devices on your
network? Is the firewall running the current software? Does the router
translation? Are there other (external 3rd party) WiFi networks
visible to systems
on your LAN? Are there BYOD's such as smart phones that could be
connected to the internet via cellular data networks?
A typical /var/log/secure entry looks like this:
Jan 30 12:43:50 redwood sshd: Invalid user jackiehulu from
18.104.22.168 port 37394
Jan 30 12:43:51 redwood sshd: Received disconnect from
22.214.171.124 port 37394:11: Bye Bye [preauth]
Jan 30 12:43:51 redwood sshd: Disconnected from invalid user
jackiehulu 126.96.36.199 port 37394 [preauth]
The corresponding journalctl is:
Jan 30 12:43:51 redwood.eagercon.com
audit: USER_ERR pid=21228
uid=0 auid=4294967295 ses=4294967295
grantors=? acct="?" exe="/usr/sbin/sshd" hostname=188.8.131.52
addr=184.108.40.206 terminal=ssh res=failed'
I'm assuming that something on the network has been compromised,
allowing SSH login attempts on the LAN. Other than turning off
each server/AP/laptop/etc, one at a time, to find when the accesses
stop, is there any way to find out where the SSH attempt is coming from?
A compromised system is unlikely to allow access to a large number of
external sites, so it is more likely to be a device (maybe inadvertently)
bridging a cellular data network or an external system connecting to your
LAN. There have been cases where bad actors just plugged in a small
system to gain access to a LAN.
As Ed suggested, getting the mac address is a start, but it may be spoofed
or a device you didn't know existed: personal device, IoT device (HVAC,
camera, etc.), or computer used to control equipment that was not supposed
to be connected to the network.
George N. White III