SSH Brute Force

Mar  3 23:09:55 grey postfix/smtpd\[25215\]: NOQUEUE: reject: RCPT from unknown\[112.23.113.230\]: 554 5.7.1 Service unavailable\; Client host \[112.23.113.230\] blocked using bl.spamcop.net\; Blocked - see https://www.spamcop.net/bl.shtml\?112.23.113.230\; from=\ to=\ proto=ESMTP helo=\
...

Mar  3 13:06:32 hanapaa sshd\[6694\]: Invalid user jiaxing from 149.129.233.149
Mar  3 13:06:32 hanapaa sshd\[6694\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.129.233.149
Mar  3 13:06:33 hanapaa sshd\[6694\]: Failed password for invalid user jiaxing from 149.129.233.149 port 37050 ssh2
Mar  3 13:10:28 hanapaa sshd\[7268\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.129.233.149  user=root
Mar  3 13:10:30 hanapaa sshd\[7268\]: Failed password for root from 149.129.233.149 port 40858 ssh2

SASL PLAIN auth failed: ruser=...

Mar  4 01:37:58 server sshd\[8193\]: Invalid user www-data from 202.29.80.133
Mar  4 01:37:58 server sshd\[8193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.80.133 
Mar  4 01:38:00 server sshd\[8193\]: Failed password for invalid user www-data from 202.29.80.133 port 50700 ssh2
Mar  4 01:39:20 server sshd\[8388\]: Invalid user bit_users from 202.29.80.133
Mar  4 01:39:20 server sshd\[8388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.80.133 
...

W 5701,/var/log/auth.log,-,-

Mar  4 02:31:37 server sshd\[19742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.202  user=root
Mar  4 02:31:39 server sshd\[19742\]: Failed password for root from 222.186.175.202 port 38574 ssh2
Mar  4 02:31:40 server sshd\[19746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.202  user=root
Mar  4 02:31:40 server sshd\[19748\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.202  user=root
Mar  4 02:31:42 server sshd\[19746\]: Failed password for root from 222.186.175.202 port 23740 ssh2
...

SSH authentication failure x 6 reported by Fail2Ban
...

Mar  3 23:34:03 debian-2gb-nbg1-2 kernel: \[5534020.574039\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=70.39.67.59 DST=195.201.40.59 LEN=48 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=UDP SPT=36247 DPT=3478 LEN=28

Mar  3 23:38:17 vps691689 sshd[3840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.46.14
Mar  3 23:38:19 vps691689 sshd[3840]: Failed password for invalid user pi from 164.132.46.14 port 59136 ssh2
...

Mar  4 00:05:45  sshd[16345]: Failed password for invalid user test2 from 212.100.155.154 port 43970 ssh2

94.102.56.215 was recorded 27 times by 13 hosts attempting to connect to the following ports: 59999,57057,61000. Incident counter (4h, 24h, all-time): 27, 159, 6431

Detected by Fail2Ban

20/3/3@17:10:01: FAIL: Alarm-Network address from=189.207.46.15
20/3/3@17:10:01: FAIL: Alarm-Network address from=189.207.46.15
...

Mar  3 19:06:36 firewall sshd[13883]: Invalid user gameserver from 120.70.100.88
Mar  3 19:06:38 firewall sshd[13883]: Failed password for invalid user gameserver from 120.70.100.88 port 39920 ssh2
Mar  3 19:15:45 firewall sshd[14251]: Invalid user nfsnobody from 120.70.100.88
...