1

I have a very odd situation with my ssh connection. Every time I connect to my server, whatever is my external ip, the connection have as source the server's external ip.

Example

    Server S.O.:  PCLinuxOS
    Client ip:    [C.C.C.C]
    Server ip:    [S.S.S.S]

After ssh successful connection, I execute the "last" command and I get this:

username pts/0        [S.S.S.S]   Wed Jan 29 19:29   still logged in

This is the result of netstat searching for port 22:

$ netstat -atn | egrep '(:22)'
tcp        0     96 192.168.1.34:22            [S.S.S.S]:31685        ESTABLISHED

I can't find the client ip [C.C.C.C] anywhere.

I wouldn't have any particular issue on this, but now comes the best part. I found an attack on my server inside the auth.log:

Jan 27 12:55:42 localhost sshd[2295]: Invalid user a from [S.S.S.S]
Jan 27 12:55:42 localhost sshd[2295]: input_userauth_request: invalid user a [preauth]
Jan 27 12:55:42 localhost sshd[2299]: Invalid user a from [S.S.S.S]
Jan 27 12:55:42 localhost sshd[2299]: input_userauth_request: invalid user a [preauth]
Jan 27 13:49:58 localhost sshd[17917]: Invalid user jack from [S.S.S.S]
Jan 27 13:49:58 localhost sshd[17917]: input_userauth_request: invalid user jack [preauth]
Jan 27 13:50:07 localhost sshd[17923]: Invalid user ibsadmin from [S.S.S.S]
Jan 27 13:50:07 localhost sshd[17923]: input_userauth_request: invalid user ibsadmin [preauth]

After this attack the result is that my fail2ban daemon will insert the server IP [S.S.S.S] on the banned list and I can't connect to my server anymore.

The server is behind a router with a NAT port forwarding on ssh port. The issue is not present when I connect to the server from inside my LAN, the correct IP is showed in this case. This is my sshd_config file:

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_IDENTIFICATION LC_ALL
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AuthorizedKeysFile      .ssh/authorized_keys
ChallengeResponseAuthentication no
ClientAliveInterval 60
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_key
HostKey /etc/ssh/ssh_host_rsa_key
IgnoreRhosts yes
KeyRegenerationInterval 1h
LoginGraceTime 30
MaxAuthTries 2
MaxSessions 4
MaxStartups 10:30:60
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin no
Port 22
PubkeyAuthentication yes
RSAAuthentication yes
StrictModes yes
Subsystem       sftp    /usr/lib64/ssh/sftp-server
TCPKeepAlive yes
UseDNS  no
UsePAM no
UsePrivilegeSeparation yes
X11Forwarding yes

I know for sure that I didn't had this issue one month ago, but I can't figure out what is changed.

EDIT:

This is the result of iptables -L command:

$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-SSH  tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

migrated from stackoverflow.com Feb 3 '14 at 22:19

This question came from our site for professional and enthusiast programmers.

  • Do you have any noteworthy routing tables or iptables rules set-up? – tink Feb 3 '14 at 22:57
  • I never entered any rule voluntarily, how can I check? – terabyte Feb 5 '14 at 10:02
  • iptables -L will tell you all about it... – tink Feb 9 '14 at 19:48
  • @tink I have edited the question with the iptables command result. – terabyte Feb 10 '14 at 16:37
0

The problem of your own router's IP address showing up in the logs as the source of any external connection is caused by the NAT (network address translation) software running on your router. Try using a different router. (If you're comfortable with doing it, you can also reflash your router with a better firmware, such as Gargoyle).

0

After reading the 1st half, I wondered were you connecting from outside. Is the server on a private network (e.g. 192.168.x.x), is there a NATing router involved. May be the router is changing the address.

My router does not do this on ingress ports. It only re-writes the source address. So changing router may help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.