I think somebody tried to hack me

Question

root@host [/var/log]# tail -f secure
Jan  3 20:16:10 host sshd[22670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:12 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:15 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:18 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:18 host sshd[22684]: Disconnecting: Too many authentication failures for root
Jan  3 20:16:18 host sshd[22670]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:26 host sshd[23127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:28 host sshd[23127]: Failed password for root from 61.142.131.120 port 33913 ssh2
Jan  3 20:16:29 host sshd[23127]: Failed password for root from 61.142.131.120 port 33913 ssh2
Jan  3 20:16:30 host sshd[23154]: Connection closed by 61.142.131.120

61.142.131.120 is NOT my IP. So I do not know who that guy is. Moreover I can't login as root. I was lucky that I managed to logged in once. Now, even after I passwd to change password I still can't login to either whm or root.

Notice report of failed password in secure keeps coming even though I simply do not try to login anymore.

Finally things work again but with strange log

Jan  3 20:21:51 host sshd[1252]: reverse mapping checking getaddrinfo for fm-dyn-139-193-157-62.fast.net.id [139.193.157.62] failed - POSSIBLE BREAK-IN ATTEMPT!
Jan  3 20:21:55 host sshd[1252]: Accepted password for root from 139.193.157.62 port 29144 ssh2
Jan  3 20:21:55 host sshd[1252]: pam_unix(sshd:session): session opened for user root by (uid=0)

What does it mean by getaddrinfo doesn't work?

Answer 1

getaddrinfo is most likely referring to a check sshd does. When you try to ssh into a system, it runs a reverse DNS lookup on your IP address to see if it matches who you say you are. Essentially, it's an attempt to prevent spoofing.

These logs do look like some sort of attack. It's not necessarily targeted; people do try to just randomly break into systems with automated tools. You should never allow password root logins over ssh for exactly this reason. Really, PermitRootLogin in sshd_config should be set to no. If you absolutely must login to root over ssh (which is almost never the case; sometimes, you need it for a program to control your computer remotely, but you normally don't), set up SSH keys on your personal machine, and put the public key in /root/.ssh/authorized_keys on the remote machine. Turn off password root logins by changing PermitRootLogin to without-password in sshd_config. Again, though, it should probably be set to no.

More info on these sorts of attacks: “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

Answer 2

This...

Jan  3 20:21:51 host sshd[1252]: reverse mapping checking getaddrinfo for fm-dyn-139-193-157-62.fast.net.id [139.193.157.62] failed - POSSIBLE BREAK-IN ATTEMPT! 

...looks like it refers to this

On a side note, you really should disallow root login. If you don't have root access to your machine, you should think about saving all of your files to a usb or something and reinstalling your distro of choice; it's better to be on the safe side and not take chances.