SSH Intrusion Attempt

hey there folks,

just wondered if anybody could explain what this is meaning, i received this email from my VPS hosts today but the ip that they are saying the SSH intrusion was attempted from is the IP of my VPS Server? and the timezone says france but i am from the UK and the VPS server is in germany "so that would have a german ip surly"

i dont see what or how this is because i only have 3 websites on my vps which is wordpress, torrentflux-b4rt and a blank webpage

if anyone could enlighten me as to what this means i would apprechiate it.

Hello,


We recived a SSH intrusion attempt made from your IP.

See the mail we received below.


ssh intrusion attempt brute-force! --- tentative intrusion ssh par force brute !
at : 2011-04-22 10:10
from IP: 178.162.135.197
Timezone: Europe/Paris

Apr 22 08:54:51 sshd[19855]: Did not receive identification string from 178.162.135.197
Apr 22 10:10:34 sshd[21042]: reverse mapping checking getaddrinfo for 178-162-135-197.local [178.162.135.197] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 22 10:10:34 sshd[21042]: Invalid user globus from 178.162.135.197
Apr 22 10:10:34 sshd[21042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.162.135.197
ary action or we will be forced to suspend your service.

Thank You

Best Regards

Abuse Department - ScopeHosts

Code (markup):

 

So:


at : 2011-04-22 10:10
from IP: 178.162.135.197
Timezone: Europe/Paris


Somebody tried to use brute force in order to login via SSH into your VPS.

Just reply to your hosting company and ask them what you can do in order to avoid this again

 

how can they though, the ip address that they say was used is the ip address for my server

 

surely that would mean that either sombody is using one of my websites to try and ssh in to my vps?

 

So this is an ip from your server? 178.162.135.197 Than it is really strange. From your website they cannot SSH.....SSH can be used only for VPS as far as I know, Try contacting hosting by phone sometimes is the only way how you can clarify the situation

 

thank you for that reply east, thats exactly what i thought.. i have contacted them back.

 

What's so hard to understand?

Timezone has nothing to do with the location of your server. Providing the timezone in the report is handy because if you are based in a different location (or timezone) you can figure out what time it was in your locality. If the time was 10:10 in the Central Europe/Paris Timezone, and you are in the US east coast, then you would know that this happended at 01:10 in your local time. You can then use that to decide if you were working on the server at that time or check your server and logs to see if any event happened on your server at that time.

The attack CAME from your server. It attempted to SSH into another server, it was blocked, and the report was produced. The first thing I'd take from that is that someone was logged into your server and attempted to SSH into another server. My concern would be that your server/VPS may have been compromized and someone is using it to try to login to other servers on their network. You need to check that out.

You might want some clarification, but that's how I would read that email.

It also looks like their default VPSs are unmanaged so it's your job to sort it - unless you're paying for the management of your VPS.

 

i have checked my log and there has been people trying to access my ssh root but not actually gained access, i tried to change the port from 22 but it didnt take affect so it would only let me connect on port 22, so instead i have disabled ssh via cpanel as i dont really need it and my server doesnt get used that much for anything important.

thanks to all the posters who have posted a reply

 

I think the main problem is not that.. if your server is starting to brute force other server without you knowing it, than it means your server has already been penetrated. Hacker has already gain access to it and possibly leave a backdoor program to gain future access.