Juan Convers

I run a small VPS for some personal projects, and I often check the SSH logs to see who’s trying to break in. I have the standard setup: key-based authentication, password login disabled, non-default ssh port and fail2ban configured to block IPs after a few failed attempts. But that doesn’t stop the bots from trying.

This week, I decided to do a little analysis of the SSH logs to see where the attacks are coming from and the resutls are not surprising but still interesting.

Nearly 31,000 failed login attempts from the top 20 IPs alone. Russia takes the lead with 45% of attacks (20,742 attempts), followed by the US at 30% (8,163 attempts). One particularly persistent Russian IP tried over 9,600 times. Points for determination, I guess?

The geographic diversity is almost impressive: Russia, US, China, Brazil, South Korea all represented. It’s like a World Cup of “please let me into your server.”

This is just life when you have an ssh server exposed to the internet. I decided to add some additional security measures this week after seeing the data, but I wanted to share the conclusion of this analysis as a public service to anyone else who might be running a VPS with SSH access.

Stay safe out there.

Top 20 most common IP addresses

Last night when I was reading about the EgyptAir hijacking I was thinking that fortunately these type of incidents are now very rare. I remember when I was a kid that these was one of the cliches in the American movies of the 80's (ie. Delta Force), but with the tough security measures in place in most of the airports, this doesn't happen as often.

Wikipedia has a detailed compilation on the aircraft hijacking incidents and there is defintively a decrease compared to the peak on the 70s.

Wikipedia has a list of the terrorist incidents that happened during the current year. Based on this information those are the countries most affected by number of terror incidents: