0

I have a Raspberry Pi running Debian Jessie. I have pi-hole installed to block ad-serving domains (https://pi-hole.net). Going through the logs I noticed al lot of queries from a Chinese domain.

lsof -i shows me the following list that I feel is suspected:

> sshd      1742             root    3u  IPv4  16960      0t0  TCP
> raspberrypi:ssh->116.31.116.47:50600 (ESTABLISHED) sshd      1743     
> sshd    3u  IPv4  16960      0t0  TCP
> raspberrypi:ssh->116.31.116.47:50600 (ESTABLISHED) sshd      1774     
> root    3u  IPv4  16990      0t0  TCP
> raspberrypi:ssh->183.214.141.105:56265 (ESTABLISHED) sshd      1775   
> sshd    3u  IPv4  16990      0t0  TCP
> raspberrypi:ssh->183.214.141.105:56265 (ESTABLISHED) sshd      1869   
> root    3u  IPv4  17068      0t0  TCP
> raspberrypi:ssh->116.31.116.47:33525 (ESTABLISHED) sshd      1870     
> sshd    3u  IPv4  17068      0t0  TCP
> raspberrypi:ssh->116.31.116.47:33525 (ESTABLISHED) sshd      1910     
> root    3u  IPv4  17122      0t0  TCP
> raspberrypi:ssh->116.31.116.47:35816 (ESTABLISHED) sshd      1911     
> sshd    3u  IPv4  17122      0t0  TCP
> raspberrypi:ssh->116.31.116.47:35816 (ESTABLISHED) sshd      1931     
> root    3u  IPv4  17158      0t0  TCP
> raspberrypi:ssh->116.31.116.47:49492 (ESTABLISHED) sshd      1932     
> sshd    3u  IPv4  17158      0t0  TCP
> raspberrypi:ssh->116.31.116.47:49492 (ESTABLISHED) sshd      1935     
> root    3u  IPv4  17163      0t0  TCP
> raspberrypi:ssh->183.214.141.105:23828 (ESTABLISHED) sshd      1936   
> sshd    3u  IPv4  17163      0t0  TCP
> raspberrypi:ssh->183.214.141.105:23828 (ESTABLISHED) sshd      1937   
> root    3u  IPv4  17168      0t0  TCP
> raspberrypi:ssh->116.31.116.47:53628 (ESTABLISHED) sshd      1938     
> sshd    3u  IPv4  17168      0t0  TCP
> raspberrypi:ssh->116.31.116.47:53628 (ESTABLISHED) sshd      1940     
> root    3u  IPv4  17176      0t0  TCP
> raspberrypi:ssh->116.31.116.47:57858 (ESTABLISHED) sshd      1941     
> sshd    3u  IPv4  17176      0t0  TCP
> raspberrypi:ssh->116.31.116.47:57858 (ESTABLISHED) sshd      1944     
> root    3u  IPv4  17194      0t0  TCP
> raspberrypi:ssh->183.214.141.105:28355 (ESTABLISHED) sshd      1945   
> sshd    3u  IPv4  17194      0t0  TCP
> raspberrypi:ssh->183.214.141.105:28355 (ESTABLISHED)

I already changed my password, restarted my Pi and checked for any unknown users (which there were none). How do I proceed making my Pi secure again?

2

There may or may not be a security breach.

It may just be an idiot trying to brute force crack passwords. If they connect, try a password, it fails, they don't try another or close the connection then you can see these connections which will eventually be closed by the sshd.

/var/log/auth.log

should have some information on the login attempts. the last command may show you successful logins.

  • Thanks, this was very helpful. Indeed it looked like a brute force attack. One of the first things I have done now is install fail2ban (iot-projects.com/…). I'll furthermore consider single packet authorization and blocking incoming Chinese and Russian IP addresses at my router. – Vincent Jan 12 '17 at 4:42
  • You might find sites like ipdeny.com/ipblocks helpful. – icarus Jan 12 '17 at 5:14
  • I do not got that file on arch nor fedora – aurelien Jan 12 '17 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.