Making sense of auth log

Question

I am seeing some log enties that look like hacking attempts

Type 1

Dec 26 03:09:01 ... CRON[9271]: pam_unix(cron:session): session closed for user root
Dec 26 03:17:01 ... CRON[9308]: pam_unix(cron:session): session opened for user root by (uid=0)

Type 2

Dec 26 03:27:11 ... sshd[9364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.217.235.5  user=root
Dec 26 03:27:12 ... sshd[9364]: Failed password for root from 60.217.235.5 port 47933 ssh2

What does these mean? They usually come in 5's. I enabled ufw limit ssh. So I think UFW is trottling this. But wonder why are there 2 kinds, 1 authentication failure, 1 session closed.

I suppose I should respond to this by using denyhosts, changing ssh port & disable root login? What else can I do? Last time I used deny hosts, it blocked me too ... Also can I increase the UFW retry time? Like only allow login 1hour later? Perhaps reduce the login attempts to 3?

Answer 1

As already mentioned, the first type does not come from any SSH related stuff, its an activity log of your cron deamon and this is not harmful, but usual. The second one might be login attempts from a hacker, and these should be followed. denyhosts might help you, but disabling the possibility for root logins is also a very good idea (in addition to denyhosts, not instead of!)

Answer 2

The messages from CRON record normal activity. These are scheduled tasks (probably executed hourly or daily) that are executed by root.

The messages from SSH indicate that someone tried to log in as root. There are bots that try random addresses and attempt to log in with weak passwords or to exploit security holes. Most people can ignore these attempts, all you need is to observe simple hygiene:

• Either disable password authentication altogether in /etc/sshd_config (possibly /etc/ssh/sshd_config or some similar location depending on your distribution) by setting PasswordAuthentication No; or make sure that every user on your system has a strong password (not a dictionary word or a simple variation on one).
• Make sure your ssh server is up-to-date (no known security holes).

You can implement more stringent measures if the attempts are using a significant portion of your bandwidth or CPU or logging space, but beware that restricting SSH could lock you out one day. Changing the port will make you invisible to most bots (you're no longer amongst the lowest hanging fruit), but then you may be unable to log in through some firewalls (if you do want to change the port, and you aren't running an HTTPS server, 443 is good because most firewalls allow HTTPS and can't tell the difference with SSH). Denyhosts will keep the number of attempts down. Port knocking is yet another method, but it's not very useful: you can only log in from a machine that you control that is not behind a stringent firewall, and the benefit is fairly small.

Answer 3

You can use a method called "port knocking".

Google "iptables port knocking".

To outside world this will look like as you have no ssh server running.