I have a question regarding log files on a Debian box. I'm running a low volume PHP server, so most log files are small. However, auth, fail2ban (and daemon) are huge, even with log rotation.

2000K auth.log
 600K fail2ban.log
 200K daemon.log
   5K dpkg.log
   5K mail.log
   5K alternatives.log
   1K user.log
   1K kern.log
   1K php7.0-fpm.log

fail2ban contains only lots of lines with INFO/NOTICE [sshd] Found (IP) and auth contains various lines with user unknown and Failed password, presumably from automated attacks.

(SSH on the server has password logins turned off and is only accessible by RSA keys.)

I can't be reading through auth.log manually, and failed login attempts seems like information of no value, since it's happening all the time (and did fail), so how do I relate to these two files?

Can I configure them to contain less information? Is there a way to aggregate all the failures? Is there anything in them at all that would identify a more serious or actual break-in?

Or should I just ignore the log files and focus on general system hardening, and accept that the log files unfortunately will have a lot of noise in this day and age?

  • 1
    Consider changing from the default SSH 22 port to something else. – LinuxSecurityFreak Sep 14 '18 at 6:46

You should change the port the SSH servers runs on from 22 to another (higher) port, for instance 22222.

Automated attackers use the default port, so they won't be able to connect, and therefore won't be logged.

While this countermeasure is useless against a human attacker (a port scan of your server will give up the SSH port), is very effective against bots. Think of it as an additional layer of security.

  • That seems like a simple and effective fix to try first, though I should probably use a less obvious port since attackers may be on to this scheme and check 2222, 22222, etc. OK, so set Port in sshd_config and restart the daemon, but can this go wrong somehow? (Is there any chance I won't be able to log into my own machine?) – forthrin Sep 14 '18 at 7:22
  • 1
    @forthrin, yes it may go wrong if you have FW rules that avoid access to the new port. Try running two ssh servers on different ports before removing the one on port 22. – YoMismo Sep 14 '18 at 7:28
  • I found sshd can listen on multiple ports like indicated in the link below. So I added a port, tried to log in, which worked, then removed port 22. Worked safe and sound. (I wasn't even forced out of my old port 22 shell either). Now to see if the log files diminish, which was the initial request. howtoforge.com/community/threads/… – forthrin Sep 14 '18 at 9:23
  • What about fail2ban? Will that diminish from this trick too, or how do I make that less chatty, or relate to it on a regular basis? – forthrin Sep 14 '18 at 9:25
  • There will be less login attempts, so fail2ban will contain fewer entries. Note that you can also lower the log level to have less stuff logged -- from your post, fail2ban is logging at the INFO level. – dr01 Sep 14 '18 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.