Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a very odd situation with my ssh connection. Every time I connect to my server, whatever is my external ip, the connection have as source the server's external ip.

Example

    Server S.O.:  PCLinuxOS
    Client ip:    [C.C.C.C]
    Server ip:    [S.S.S.S]

After ssh successful connection, I execute the "last" command and I get this:

username pts/0        [S.S.S.S]   Wed Jan 29 19:29   still logged in

This is the result of netstat searching for port 22:

$ netstat -atn | egrep '(:22)'
tcp        0     96 192.168.1.34:22            [S.S.S.S]:31685        ESTABLISHED

I can't find the client ip [C.C.C.C] anywhere.

I wouldn't have any particular issue on this, but now comes the best part. I found an attack on my server inside the auth.log:

Jan 27 12:55:42 localhost sshd[2295]: Invalid user a from [S.S.S.S]
Jan 27 12:55:42 localhost sshd[2295]: input_userauth_request: invalid user a [preauth]
Jan 27 12:55:42 localhost sshd[2299]: Invalid user a from [S.S.S.S]
Jan 27 12:55:42 localhost sshd[2299]: input_userauth_request: invalid user a [preauth]
Jan 27 13:49:58 localhost sshd[17917]: Invalid user jack from [S.S.S.S]
Jan 27 13:49:58 localhost sshd[17917]: input_userauth_request: invalid user jack [preauth]
Jan 27 13:50:07 localhost sshd[17923]: Invalid user ibsadmin from [S.S.S.S]
Jan 27 13:50:07 localhost sshd[17923]: input_userauth_request: invalid user ibsadmin [preauth]

After this attack the result is that my fail2ban daemon will insert the server IP [S.S.S.S] on the banned list and I can't connect to my server anymore.

The server is behind a router with a NAT port forwarding on ssh port. The issue is not present when I connect to the server from inside my LAN, the correct IP is showed in this case. This is my sshd_config file:

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_IDENTIFICATION LC_ALL
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AuthorizedKeysFile      .ssh/authorized_keys
ChallengeResponseAuthentication no
ClientAliveInterval 60
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_key
HostKey /etc/ssh/ssh_host_rsa_key
IgnoreRhosts yes
KeyRegenerationInterval 1h
LoginGraceTime 30
MaxAuthTries 2
MaxSessions 4
MaxStartups 10:30:60
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin no
Port 22
PubkeyAuthentication yes
RSAAuthentication yes
StrictModes yes
Subsystem       sftp    /usr/lib64/ssh/sftp-server
TCPKeepAlive yes
UseDNS  no
UsePAM no
UsePrivilegeSeparation yes
X11Forwarding yes

I know for sure that I didn't had this issue one month ago, but I can't figure out what is changed.

EDIT:

This is the result of iptables -L command:

$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-SSH  tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
share|improve this question

migrated from stackoverflow.com Feb 3 at 22:19

This question came from our site for professional and enthusiast programmers.

    
Do you have any noteworthy routing tables or iptables rules set-up? –  tink Feb 3 at 22:57
    
I never entered any rule voluntarily, how can I check? –  terabyte Feb 5 at 10:02
    
iptables -L will tell you all about it... –  tink Feb 9 at 19:48
    
@tink I have edited the question with the iptables command result. –  terabyte Feb 10 at 16:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.