I have a very odd situation with my ssh connection. Every time I connect to my server, whatever is my external ip, the connection have as source the server's external ip.
Server S.O.: PCLinuxOS Client ip: [C.C.C.C] Server ip: [S.S.S.S]
After ssh successful connection, I execute the "last" command and I get this:
username pts/0 [S.S.S.S] Wed Jan 29 19:29 still logged in
This is the result of netstat searching for port 22:
$ netstat -atn | egrep '(:22)' tcp 0 96 192.168.1.34:22 [S.S.S.S]:31685 ESTABLISHED
I can't find the client ip [C.C.C.C] anywhere.
I wouldn't have any particular issue on this, but now comes the best part. I found an attack on my server inside the auth.log:
Jan 27 12:55:42 localhost sshd: Invalid user a from [S.S.S.S] Jan 27 12:55:42 localhost sshd: input_userauth_request: invalid user a [preauth] Jan 27 12:55:42 localhost sshd: Invalid user a from [S.S.S.S] Jan 27 12:55:42 localhost sshd: input_userauth_request: invalid user a [preauth] Jan 27 13:49:58 localhost sshd: Invalid user jack from [S.S.S.S] Jan 27 13:49:58 localhost sshd: input_userauth_request: invalid user jack [preauth] Jan 27 13:50:07 localhost sshd: Invalid user ibsadmin from [S.S.S.S] Jan 27 13:50:07 localhost sshd: input_userauth_request: invalid user ibsadmin [preauth]
After this attack the result is that my fail2ban daemon will insert the server IP [S.S.S.S] on the banned list and I can't connect to my server anymore.
The server is behind a router with a NAT port forwarding on ssh port. The issue is not present when I connect to the server from inside my LAN, the correct IP is showed in this case. This is my sshd_config file:
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_IDENTIFICATION LC_ALL AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AuthorizedKeysFile .ssh/authorized_keys ChallengeResponseAuthentication no ClientAliveInterval 60 HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_key HostKey /etc/ssh/ssh_host_rsa_key IgnoreRhosts yes KeyRegenerationInterval 1h LoginGraceTime 30 MaxAuthTries 2 MaxSessions 4 MaxStartups 10:30:60 PasswordAuthentication no PermitEmptyPasswords no PermitRootLogin no Port 22 PubkeyAuthentication yes RSAAuthentication yes StrictModes yes Subsystem sftp /usr/lib64/ssh/sftp-server TCPKeepAlive yes UseDNS no UsePAM no UsePrivilegeSeparation yes X11Forwarding yes
I know for sure that I didn't had this issue one month ago, but I can't figure out what is changed.
This is the result of iptables -L command:
$ iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-SSH (1 references) target prot opt source destination RETURN all -- anywhere anywhere