0

I have never seen this before in my sshd logs:

Mar 16 17:21:48 x-server sshd[9848]: Bad protocol version identification '\026\003\001' from 45.143.221.50 port 35026
Mar 16 17:21:48 x-server sshd[9849]: Bad protocol version identification '\026\003\001' from 45.143.221.50 port 35254
Mar 16 17:21:48 x-server sshd[9850]: Bad protocol version identification 'GET / HTTP/1.1' from 45.143.221.50 port 35384
Mar 16 17:21:48 x-server sshd[9851]: Bad protocol version identification 'GET /vtigercrm/vtigerservice.php HTTP/1.1' from 45.143.221.50 port 35608
Mar 16 17:21:48 x-server sshd[9852]: Bad protocol version identification '\026\003\001' from 45.143.221.50 port 35810
Mar 16 17:21:48 x-server sshd[9853]: Bad protocol version identification 'GET /a2billing/admin/Public/index.php HTTP/1.1' from 45.143.221.50 port 36000
Mar 16 20:57:24 x-server sshd[10424]: Bad protocol version identification 'GET / HTTP/1.1' from 18.206.190.72 port 43800

This attack seems to send http requests through an SSH connection initiation while no webserver is running on this machine and no PHP is installed. It is also a mystery to me how the ports have been mapped to sshd in these cases since this sshd is behind a NAT and is not directly connected to the internet.

How can I mitigate such an attack?

4

I have no idea about how it got past a NAT. But I will answer the rest.

A port is not a protocol: While ssh is usually on port 22, and http on port 80. This is only so we can find them easily. There is nothing fixed about these protocols and ports.

What seems to have happened is a web-browser (or web-spider) has tried to connect to port 22 (maybe it is trying all the ports). You ssh-server is completely safe from this. It is an example of a client not authenticating properly. Just ensure that your logs are rotated, so they don't fill-up your drive.

There is no ssh connection. The ssh connection is not yet up, the connection is still at the level of TCP/IP.

The request coming from the remote, is independent of the software installed on your machine. For example, when someone connects to a web-site they do not, first, check to see what software is installed on the server.

2
  • Thanks for the quick answer. I have one arbitrarily chosen port forwarded to port 22 of this machine. They have probably been checking all the ports up to that one, which is way above the privileged port range – Chris V Mar 16 '20 at 21:43
  • That will explain how it got past the NAT. There is no need to worry about privileged ports. They are just to stop un-privileged users from blocking/spoofing services. Because the port is randomly chosen, an attacker will have no idea what is on the port. – ctrl-alt-delor Mar 16 '20 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.