Why are these people trying to break into my computer? - Webdetector Webmaster Forums

apeskape0012 · **iTrader:** (0) #1 (**permalink**) 06-28-2008, 09:21 AM

I have a Linux server I set up at home which I can access from anywhere on the internet. Also have a script set up to check my /var/log/secure file for unauthorized attempts. My question is why are all these people trying to gain access? It's not like it's a bank or anything..
(part of my hosts.deny file is here) and all the attempts are SSH (telnet logins aren't allowed, only SSH, and everything I do is thru an SSH tunnel.

ALL:125.63.87.194
ALL:218.108.10.116
ALL:79.187.3.50
ALL:218.38.55.188
ALL:64.79.196.167
ALL:41.207.177.20

ALL:74.94.201.22
ALL:128.121.21.39
ALL:211.239.120.254
ALL:69.60.115.120
ALL:64.192.63.152
ALL:83.3.86.106
ALL:85.234.158.73
ALL:201.31.44.5
ALL:202.213.248.219
ALL:210.48.146.162
ALL:219.235.66.115
ALL:201.80.197.70
ALL:219.239.98.111
ALL:67.192.61.213
ALL:222.69.93.27
ALL:200.184.44.146
ALL:218.62.83.66
ALL:87.120.43.108
ALL:216.126.224.8

Why are these people so nosy? Tempted to start emailing their service providers.
True, I usually do a whois on them, and they are mostly from China, Ukraine, Italy, and one from Utah.

cazzypooh · **iTrader:** (0) #2 (**permalink**) 06-28-2008, 11:29 AM

hackers - also might be spam folks trying to break your system to steal personal information, just because your not a bank does not mean you don't have value.

dvrman123 · **iTrader:** (0) #3 (**permalink**) 06-28-2008, 12:33 PM

Simple answer. If it's out there, they will find it and try to hack into it.

Dirty rotten human nature.

cazzypooh · **iTrader:** (0) #4 (**permalink**) 06-28-2008, 01:05 PM

The first half dozen are all overseas...ISPs probably won't help. I'm sure some of those are out of cybercafes, too.

CarlSunshine · **iTrader:** (0) #5 (**permalink**) 06-28-2008, 02:09 PM

What you are seeing is just bots. I run a number of linux and unix servers and I see them all the time. They scan a random range of IP addresses and subnets and then when they find an open SSH port they start trying to brute force common logins and passwords. Those computers are probably just zombies

You're running linux so install "Fail2ban" which will ban an IP after three attempts. It's configurable so adjust it to your likes.

Another tip to help you is to change your SSH port to something nonstandard such as 2222, 2200 or whatever you can remember. The bots I've seen always scan standard ports so that alone should stop them from trying to brute force your box.