I am seeing some log enties that look like hacking attempts
Dec 26 03:09:01 ... CRON: pam_unix(cron:session): session closed for user root Dec 26 03:17:01 ... CRON: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 26 03:27:11 ... sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.127.116.11 user=root Dec 26 03:27:12 ... sshd: Failed password for root from 18.104.22.168 port 47933 ssh2
What does these mean? They usually come in 5's. I enabled
ufw limit ssh. So I think UFW is trottling this. But wonder why are there 2 kinds, 1 authentication failure, 1 session closed.
I suppose I should respond to this by using
denyhosts, changing ssh port & disable root login? What else can I do? Last time I used deny hosts, it blocked me too ... Also can I increase the UFW retry time? Like only allow login 1hour later? Perhaps reduce the login attempts to 3?