4 ms·
Wow, so this article was impetus enough for me to get key-based SSH working correctly on my Synology. Of curiousity, I looked in my Synology's GUI for the logs
by clebio 12y ago
Wow, so this article was impetus enough for me to get key-based SSH working correctly on my Synology.
Of curiousity, I looked in my Synology's GUI for the logs, and find you can export them to CSV (System Logs > Connections).
I have _a lot_ of this sort:
Warning,Connection,2014/08/03 21:10:17,SYSTEM,User [root] from [111.74.239.52] failed to log in via [SSH] due to authorization failure.
Curious how many distinct IPs, cut/grep/sed/sort:
cut -d ' ' -f 5 ~/Downloads/connection.csv | grep -E '[0-9.]+' | sed 's/\[//' | sed 's/\]//' | sort -u | wc
There are 143 distinct IPs, in the 111.x.y.z, 202, 210, 222, etc. ranges:
... cut -d '.' -f -2 | sort -u
111.74
115.230
115.239
...
220.177
222.186
222.187
I punched a few into (http://www.whereisip.net/index.php http://www.whereisip.net/index.php) and they're mostly in China (except a 23.9... in Rochester, NY). All the successful log-ins are from myself, at least ( grep 'logged in' ...).
- cpbotha 12y agoOpen the Control Panel, then select Security (under "Connectivity"), then the "Auto Block" tab and check "Enable auto block". Kiddies will scan, this blocks their IP numbers after N (by default 5) failed attempts to connect to a number of services, including SSH. My synology has blocked large parts of the internet over the past few months. :) (only my SSH port is open to the outside so that my laptops can synchronize with my Synology via unison over SSH when I'm on the road.)
- hrrsn 12y agoAny open SSH port will get these kinds of hits.
- eric_h 12y agoOur cloud ssh gateway gets literally thousands of hits like this a day to users like root, mysql, oracle, etc. If you've got an ssh host open to the internet at large, always disable root login and password based authentication.
- tehaugmenter 12y agoChange the port your SSH is on to something other than 22.
- clebio 12y agoDoes obfuscation help with security? Or does it at least help with identification in some way?