You've got hacked :)

Yup since I opened up the ssh ports, once a day someone tries to get into the system. Here a small piece of log,
Oct 13 17:19:07 *******-server sshd[7250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.117.255.223 user=nobody
Oct 13 17:19:09 *******-server sshd[7250]: Failed password for nobody from 58.117.255.223 port 35131 ssh2
Oct 13 17:19:17 *******-server sshd[7255]: Invalid user patrick from 58.117.255.223
Oct 13 17:19:17 *******-server sshd[7255]: pam_unix(sshd:auth): check pass; user unknown
Oct 13 17:19:17 *******-server sshd[7255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.117.255.223
Oct 13 17:19:19 *******-server sshd[7255]: Failed password for invalid user patrick from 58.117.255.223 port 35703 ssh2
Oct 13 17:23:50 *******-server sshd[7325]: Invalid user jane from 58.117.255.223
Oct 13 17:23:50 *******-server sshd[7325]: pam_unix(sshd:auth): check pass; user unknown
Oct 13 17:23:50 *******-server sshd[7325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.117.255.223
Oct 13 17:23:52 *******-server sshd[7325]: Failed password for invalid user jane from 58.117.255.223 port 52794 ssh2
Oct 13 17:23:59 *******-server sshd[7327]: Invalid user pamela from 58.117.255.223
Oct 13 17:23:59 *******-server sshd[7327]: pam_unix(sshd:auth): check pass; user unknown
Oct 13 17:23:59 *******-server sshd[7327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.117.255.223
The address belongs to some kid in China (Beijing Education Information Network). The box has been safe so far.

No comments: