Repeated login attempts from china!

rmarkjr · December 21, 2016, 7:02am

nextcloud 11 after upgrade
Https enabled
Strict Https enabled
ubuntu server 16.04
Ufw enabled with apache and ssh

so here is something I was not expecting. I checked the auth.log and I see login attempt after login attempt from several different IP addresses and they all come from China so far. There are MANY login attempts from each IP address.

This is what I get


Dec 21 00:14:00 ubuntu sshd[8257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.1$
Dec 21 00:14:01 ubuntu sshd[8257]: Failed password for root from 218.65.30.124 port 50235 ssh2
Dec 21 00:14:07 ubuntu sshd[8257]: message repeated 2 times: [ Failed password for root from 218.65.30.124 port 50235 ssh2]
Dec 21 00:14:08 ubuntu sshd[8259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.$
Dec 21 00:14:10 ubuntu sshd[8257]: Failed password for root from 218.65.30.124 port 50235 ssh2
Dec 21 00:14:10 ubuntu sshd[8259]: Failed password for root from 58.218.199.182 port 60398 ssh2
Dec 21 00:14:12 ubuntu sshd[8257]: Failed password for root from 218.65.30.124 port 50235 ssh2
Dec 21 00:14:12 ubuntu sshd[8259]: Failed password for root from 58.218.199.182 port 60398 ssh2
Dec 21 00:14:14 ubuntu sshd[8259]: Failed password for root from 58.218.199.182 port 60398 ssh2
Dec 21 00:14:15 ubuntu sshd[8257]: Failed password for root from 218.65.30.124 port 50235 ssh2
Dec 21 00:14:15 ubuntu sshd[8257]: error: maximum authentication attempts exceeded for root from 218.65.30.124 port 50235 ssh2 [preaut$
Dec 21 00:14:15 ubuntu sshd[8257]: Disconnecting: Too many authentication failures [preauth]
Dec 21 00:14:15 ubuntu sshd[8257]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.124  user=$
Dec 21 00:14:15 ubuntu sshd[8257]: PAM service(sshd) ignoring max retries; 6 > 3
Dec 21 00:14:15 ubuntu sshd[8259]: Received disconnect from 58.218.199.182 port 60398:11:  [preauth]
Dec 21 00:14:15 ubuntu sshd[8259]: Disconnected from 58.218.199.182 port 60398 [preauth]
Dec 21 00:14:15 ubuntu sshd[8259]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  user$
Dec 21 00:14:20 ubuntu sshd[8261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.1$
Dec 21 00:14:22 ubuntu sshd[8261]: Failed password for root from 218.65.30.124 port 16010 ssh2
Dec 21 00:14:48 ubuntu sshd[8261]: message repeated 5 times: [ Failed password for root from 218.65.30.124 port 16010 ssh2]
Dec 21 00:14:48 ubuntu sshd[8261]: error: maximum authentication attempts exceeded for root from 218.65.30.124 port 16010 ssh2 [preaut$
Dec 21 00:14:48 ubuntu sshd[8261]: Disconnecting: Too many authentication failures [preauth]
Dec 21 00:14:48 ubuntu sshd[8261]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.124  user=$
Dec 21 00:14:48 ubuntu sshd[8261]: PAM service(sshd) ignoring max retries; 6 > 3
Dec 21 00:14:54 ubuntu sshd[8263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.$
Dec 21 00:14:55 ubuntu sshd[8265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.1$
Dec 21 00:14:56 ubuntu sshd[8263]: Failed password for root from 58.218.199.182 port 19671 ssh2
Dec 21 00:14:56 ubuntu sshd[8263]: Received disconnect from 58.218.199.182 port 19671:11:  [preauth]
Dec 21 00:14:56 ubuntu sshd[8263]: Disconnected from 58.218.199.182 port 19671 [preauth]
Dec 21 00:14:56 ubuntu sshd[8265]: Failed password for root from 218.65.30.124 port 7953 ssh2
Dec 21 00:15:11 ubuntu sshd[8265]: message repeated 5 times: [ Failed password for root from 218.65.30.124 port 7953 ssh2]
Dec 21 00:15:11 ubuntu sshd[8265]: error: maximum authentication attempts exceeded for root from 218.65.30.124 port 7953 ssh2 [preauth]
Dec 21 00:15:11 ubuntu sshd[8265]: Disconnecting: Too many authentication failures [preauth]
Dec 21 00:15:11 ubuntu sshd[8265]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.65.30.124  user=$
Dec 21 00:15:11 ubuntu sshd[8265]: PAM service(sshd) ignoring max retries; 6 > 3
Dec 21 00:15:25 ubuntu sshd[8269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.$
Dec 21 00:15:27 ubuntu sshd[8269]: Failed password for root from 58.218.199.182 port 61976 ssh2
Dec 21 00:15:35 ubuntu sshd[8269]: Failed password for root from 58.218.199.182 port 61976 ssh2
Dec 21 00:15:35 ubuntu sshd[8269]: Received disconnect from 58.218.199.182 port 61976:11:  [preauth]
Dec 21 00:15:35 ubuntu sshd[8269]: Disconnected from 58.218.199.182 port 61976 [preauth]
Dec 21 00:15:35 ubuntu sshd[8269]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  user=$
Dec 21 00:16:07 ubuntu sshd[8272]: Received disconnect from 58.218.199.182 port 60230:11:  [preauth]
Dec 21 00:16:07 ubuntu sshd[8272]: Disconnected from 58.218.199.182 port 60230 [preauth]
Dec 21 00:16:39 ubuntu sshd[8276]: Connection reset by 58.218.199.182 port 23047 [preauth]
Dec 21 00:17:01 ubuntu CRON[8279]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 21 00:34:58 ubuntu sshd[8649]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:35:44 ubuntu sshd[8651]: Connection closed by 58.218.199.182 port 20803 [preauth]

Dec 21 00:35:57 ubuntu sshd[8653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:35:59 ubuntu sshd[8653]: Failed password for root from 58.218.199.182 port 24485 ssh2

Dec 21 00:36:04 ubuntu sshd[8653]: Failed password for root from 58.218.199.182 port 24485 ssh2

Dec 21 00:36:04 ubuntu sshd[8653]: Received disconnect from 58.218.199.182 port 24485:11:  [preauth]

Dec 21 00:36:04 ubuntu sshd[8653]: Disconnected from 58.218.199.182 port 24485 [preauth]

Dec 21 00:36:04 ubuntu sshd[8653]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  us$

Dec 21 00:36:32 ubuntu sshd[8655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:36:34 ubuntu sshd[8655]: Failed password for root from 58.218.199.182 port 12977 ssh2

Dec 21 00:36:39 ubuntu sshd[8655]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 12977 ssh2]

Dec 21 00:36:41 ubuntu sshd[8655]: Received disconnect from 58.218.199.182 port 12977:11:  [preauth]

Dec 21 00:36:41 ubuntu sshd[8655]: Disconnected from 58.218.199.182 port 12977 [preauth]

Dec 21 00:36:41 ubuntu sshd[8655]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:37:08 ubuntu sshd[8657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:37:11 ubuntu sshd[8657]: Failed password for root from 58.218.199.182 port 60504 ssh2

Dec 21 00:37:16 ubuntu sshd[8657]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 60504 ssh2]

Dec 21 00:37:17 ubuntu sshd[8657]: Received disconnect from 58.218.199.182 port 60504:11:  [preauth]

Dec 21 00:37:17 ubuntu sshd[8657]: Disconnected from 58.218.199.182 port 60504 [preauth]

Dec 21 00:37:17 ubuntu sshd[8657]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:37:46 ubuntu sshd[8659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:37:48 ubuntu sshd[8659]: Failed password for root from 58.218.199.182 port 10473 ssh2

Dec 21 00:37:53 ubuntu sshd[8659]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 10473 ssh2]

Dec 21 00:37:53 ubuntu sshd[8659]: Received disconnect from 58.218.199.182 port 10473:11:  [preauth]

Dec 21 00:37:53 ubuntu sshd[8659]: Disconnected from 58.218.199.182 port 10473 [preauth]

Dec 21 00:37:53 ubuntu sshd[8659]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:38:24 ubuntu sshd[8661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:38:26 ubuntu sshd[8661]: Failed password for root from 58.218.199.182 port 18155 ssh2

Dec 21 00:38:30 ubuntu sshd[8661]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 18155 ssh2]

Dec 21 00:38:31 ubuntu sshd[8661]: Received disconnect from 58.218.199.182 port 18155:11:  [preauth]

Dec 21 00:38:31 ubuntu sshd[8661]: Disconnected from 58.218.199.182 port 18155 [preauth]

Dec 21 00:38:31 ubuntu sshd[8661]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:39:01 ubuntu CRON[8665]: pam_unix(cron:session): session opened for user root by (uid=0)

Dec 21 00:39:02 ubuntu CRON[8665]: pam_unix(cron:session): session closed for user root

Dec 21 00:39:03 ubuntu sshd[8663]: Connection reset by 58.218.199.182 port 16115 [preauth]

Dec 21 00:39:35 ubuntu sshd[8707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:39:36 ubuntu sshd[8707]: Failed password for root from 58.218.199.182 port 12765 ssh2

Dec 21 00:39:42 ubuntu sshd[8707]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 12765 ssh2]

Dec 21 00:39:43 ubuntu sshd[8707]: Received disconnect from 58.218.199.182 port 12765:11:  [preauth]

Dec 21 00:39:43 ubuntu sshd[8707]: Disconnected from 58.218.199.182 port 12765 [preauth]

Dec 21 00:39:43 ubuntu sshd[8707]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:40:16 ubuntu sshd[8710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:40:18 ubuntu sshd[8710]: Failed password for root from 58.218.199.182 port 24133 ssh2

Dec 21 00:40:18 ubuntu sshd[8710]: Received disconnect from 58.218.199.182 port 24133:11:  [preauth]

Dec 21 00:40:18 ubuntu sshd[8710]: Disconnected from 58.218.199.182 port 24133 [preauth]
Dec 21 00:40:18 ubuntu sshd[8710]: Received disconnect from 58.218.199.182 port 24133:11:  [preauth]

Dec 21 00:40:18 ubuntu sshd[8710]: Disconnected from 58.218.199.182 port 24133 [preauth]

Dec 21 00:40:55 ubuntu sshd[8712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:40:58 ubuntu sshd[8712]: Failed password for root from 58.218.199.182 port 64155 ssh2

Dec 21 00:40:58 ubuntu sshd[8712]: Received disconnect from 58.218.199.182 port 64155:11:  [preauth]

Dec 21 00:40:58 ubuntu sshd[8712]: Disconnected from 58.218.199.182 port 64155 [preauth]

Dec 21 00:41:19 ubuntu sshd[8714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:41:21 ubuntu sshd[8714]: Failed password for root from 58.218.199.182 port 23859 ssh2

Dec 21 00:41:25 ubuntu sshd[8714]: message repeated 2 times: [ Failed password for root from 58.218.199.182 port 23859 ssh2]

Dec 21 00:41:27 ubuntu sshd[8714]: Received disconnect from 58.218.199.182 port 23859:11:  [preauth]

Dec 21 00:41:27 ubuntu sshd[8714]: Disconnected from 58.218.199.182 port 23859 [preauth]

Dec 21 00:41:27 ubuntu sshd[8714]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  u$

Dec 21 00:41:54 ubuntu sshd[8720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:41:56 ubuntu sshd[8720]: Failed password for root from 58.218.199.182 port 27659 ssh2

Dec 21 00:42:03 ubuntu sshd[8720]: Failed password for root from 58.218.199.182 port 27659 ssh2

Dec 21 00:42:03 ubuntu sshd[8720]: Connection reset by 58.218.199.182 port 27659 [preauth]

Dec 21 00:42:03 ubuntu sshd[8720]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.199.182  us$

Dec 21 00:42:49 ubuntu sshd[8725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.1$

Dec 21 00:42:51 ubuntu sshd[8725]: Failed password for root from 58.218.199.182 port 38912 ssh2

Dec 21 00:42:51 ubuntu sshd[8725]: Received disconnect from 58.218.199.182 port 38912:11:  [preauth]

Dec 21 00:42:51 ubuntu sshd[8725]: Disconnected from 58.218.199.182 port 38912 [preauth]

Dec 21 00:43:43 ubuntu sshd[8730]: Did not receive identification string from 58.218.199.182

I do not know what to do about this. I do not have failban installed and dont know how to set that up. I also have not messed with IPtables and also not familiar with that at all either.

I should probably update my ssh password or password for my root account and my user account.

What is the best thing to do in this situation?

Thanks.

tflidd · December 21, 2016, 7:20am

They are usually trying the most used passwords. So with a very good password is already very good, however you can also use SSH-Keys to authenticate. Without this SSH-Key you can’t login, there is no chance to “guess” this key in a reasonable time.

How to setup up key-authentication with putty: https://system.cs.kuleuven.be/cs/system/security/ssh/setupkeys/putty-with-key.html
More info about the ssh keys: https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server

You will still get this “noise” in your logfiles but you don’t have to care about it (unless someone really manages to login). Fail2ban or a different port just reduce the noise in the logfiles, it doesn’t really increase the security but it adds a potential problem for you that you might lock out yourself. If you are interested in more, read about security by obscurity. More important: run only services you need and that you have configured properly, make security updates.

Ecphrasis · December 21, 2016, 7:55am

Installing Fail2Ban is not so complicated, mostly with one or two jails… The default parameters are goods. But the most efficient is changing listening port of SSH, I’m never attacked since my SSH server listens to a random port > 1024.

EDIT : I have also allowed only my IP to connect to SSH, wich is more efficient

ufw allow proto tcp from 1.2.3.4 to any port 2243 (SSH port)

CAREFULL : This option needs a static and stable IP, if you don’t have one or if you plan to change ISP, don’t do this !

rmarkjr · December 21, 2016, 8:04am

Thanks for the reply.

I was looking at the ssh key thing and looking at fail2ban

The thing with fail2ban is that it needs a timezone but I dont see what format that it wants. Does it want local time… central time … or something else?

also I do want it to jail site logins and SSH logins. So far the guides I am looking at are one or the other and not very descriptive.

also the ban time … is that in seconds, minutes, hours?

can it set to be permanent?

so many questions with fail2ban.

also with the SSH login with only one IP is that internal or external IP used in the tcp from IP to any port?

tflidd · December 21, 2016, 8:07am

Come on. This is extremely dangerous, a lot of people here don’t have static IPs, if you only allow access from one IP and your IP changes you have a big problem (also if you have problems with your ISP). If you run Nextcloud at home, you could limit logins to your local network (should be possible within the SSH config).

Use SSH keys, this really improves the security. All this other stuff only increases the amount of code and applications running on your system which finally can backfire.

Ecphrasis · December 21, 2016, 8:14am

Sorry, you’re right about the static IP, here, in France, most of ISP give a static IP. I disagree about Fail2Ban, who is a must-have to protect proftpd, apache, SSH, and others on my dedicated, and who is extremely efficient to do this (waves of banning last week during a huge attack on my FTP who runs at standard port 21…). But you’re right to promote SSH Keys I have edited my topic to warn about what you said

rmarkjr · December 21, 2016, 8:23am

Lol ya I kinda thigh about that whole change the IP and then screwed thing. I will look into the SSH keys.

A couple of questions I can think of right now.

Can the fork kitty be used for this? Since that is what I use.

Also how does this affect me logging into SSH with say my other computer or maybe a cell phone?

rmarkjr · December 21, 2016, 8:25am

So how did you set up fail2ban to jail logins on site and SSH?

What time zone format is needed?

Did you have to change any log paths in the config.php file?

Ecphrasis · December 21, 2016, 8:25am

it needs a timezone but I dont see what format that it wants

Never had to configure that.

So far the guides I am looking at are one or the other and not very descriptive.

On Google, you have plenty of good tutos…

mmarif · December 21, 2016, 8:31am

You will always get these things in your logs. Its so far i would say normal.

As mentioned by @tflidd use key based login.
I never allow logins with passwords to my servers. The 1st thing i do switch to key based logins with PEM key, which i can use from home and office if needed. Wrote a simple post on this for myself on my blog for future usage.

MichaIng · December 21, 2016, 1:03pm

I agree that changing the ssh port was for me the most changing step. Since I use some random WXYZ Port I never (an I mean never!) had an attack since at least half an year.

Just change the port forwarding in your router to forward from random outside port to 22 of your server. Then change the port in putty/kitty accordingly.
Alternatively change the listening port in your sshd_config and accordingly in router an putty/kitty.

Both extremely easy and effektiv against random attacks, that of course go on random ports, because they are most promising in random case .

Here the steps I did and wrote down how I switched to to key authentication for ssh:

Download PuttyGen: https://the.earth.li/~sgtatham/putty/latest/x86/puttygen.exe
Start puttygen.exe, choose 4096 bit key size (at least I would recommend that) and go Generate.
You can also choose some pass phrase here. Without you could login without any password but as someone could potentially get your private key, I would always recommend to secure it further with a pass phase.
After done Safe private key to some secure folder on your local (remote) system
On your server system do “mkdir ~/.ssh” to create “.ssh” folder in your users home directory
In this directory create file named authorized_keys (nano ~/.ssh/authorized_keys) and copy the shown public key from PuttyGen into this file.
In Putty/Kitty go to Connection>SSH>Auth and choose the private key from your local system there.
At last change on your server /etc/ssh/sshd_config

RSAAuthentication yes
PubkeyAuthentication yes

Relog into your server and see if login with your key pair works as expected.
If everything works fine, disable the possibility of user password login by choosing “PasswordAuthentication no” inside /etc/ssh/sshd_config.

Actually after that I would not see fail2ban as necessary one any more. But I also use it, why not… If the time zone is asked for, it only make sense that it needs the log-files time zone. fail2ban analyses the /var/log/auth.log for login failures to ban the related ip adress. So just see which time zone is used there by comparing your local time with the one used in the log for your last authentication. For ssh fail2ban then works out of the box.

Nextcloud has already an integrated brute force protection, so fail2ban would just double that. Anyway before I knew that, I also enabled fail2ban to secure owncloud/nextcloud logins by doing these steps:

nano /etc/fail2ban/filter.d/nextcloud.conf

[Definition]
failregex={“reqId”:“.“,“remoteAddr”:”.”,“app”:“core”,“message”:“Login failed: '.’ (Remote IP: ‘’)“,“level”:2,“time”:”.”}
ignoreregex =

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

nano /etc/fail2ban/jail.local

…add to the end of the file
[nextcloud]
enabled = true
port = http,https
filter = nextcloud
maxretry = 3
bantime = 600
logpath = <path to nextcloud data folder>/nextcloud.log

Of course adjust maxretry and bantime to your needs.

service fail2ban restart

rmarkjr · December 22, 2016, 7:32am

@tflidd @MichaIng @mmarif

Hey Thank you all for the replies and the help!

I have changed the SSH port from the default.

made sure root login was disabled.

Tried fail2ban on a different test server … failed at setting that up … work in progress…

BUT…
I have created a public key paired with a private key in another test server and that works well. Set up with Pageant.

However I do have a question about this. I have read a few things, messed with this a bit, and I do not understand how this helps protect me.

in the other server I set up the private key on with passphrase. I used my phone and was able to login with the username and password.

if I can login on another device with username and password and just accept the key, then whats stopping someone from brute forcing my password still and logging in? I guess I dont or cant figure out how this helps … I know I might be a bit slowww here at this lol.

any thoughts or explanations would be great! Thanks again!

MichaIng · December 22, 2016, 8:45am

Hmm when switching “PasswordAuthentication” inside your /etc/ssh/sshd_config to “no” it should be not possible any more to login without the privat key on the local system.

Did you check 1st, that your login really worked as key login with private key pass phase and not as normal user/password login? You SSH client should say something like “Authenticating with public key "rsa-key-<creationDate>"”, maybe using Pageant this looks different, don’t know. Recheck PubkeyAuthentication is set to yes and not commented out anymore. RSAAuthentication is set to yes by default, if it is not set by the way.

If that is the case recheck also that “PasswordAuthentication no” is not commented out anymore.

For debugging you could check /var/log/auth.log. My log shows:
Accepted publickey for <user> from <ip> port <port> ssh2: RSA xx:yy:zz:...

Would be interesting what it shows for your login with phone, where private key should be not there.

rmarkjr · December 22, 2016, 8:50am

Hello
I did set it up and it does verify with the private key and the passphrase fine. When I use Pageant it does the passphrase for me.

I was able to login through my phone with user name and PW.

and as I am typing this I do now see that the PasswordAuthentiction was set to yes.

Just tried it again and now I cant login with user name and password… just with the key and passphrase.

hmm this is interesting… so is this the only reason to set that up? like to disable the password login? or does it make it more secure somehow with the password enabled?

Thanks again!

MichaIng · December 22, 2016, 9:03am

Yes, it only makes the thing more secure, if you disable password authentication. Otherwise nothing changes, besides you could make your login one step faster, by also using no passphrase for the key.

As your setup is now: Instead of username and password you now need username and passphrase, so until here nothing changed. BUT you also need a private key file with random 2048 or 4096 bit length that definitely can’t be guessed in a reasonable time, as it is theoretically for passwords. At the end you added a way stronger second factor for accessing to your server.

Of course this is just the case, if nobody has your private key and therefore also nobody has access to your local system. Therefore the passphrase make sense, that even in this case you at least have still kind of user/password security.

rmarkjr · December 22, 2016, 6:17pm

ok that makes sense.

I dont think that I have seen that step in any of the guides. I appreciate the help

Yomark1 · January 4, 2017, 4:32pm

There is no reason why you want sshd “open” for the whole world, or HTTP(s) for that matter.
It’s a good thing to just block everything from China(and/or other countries you do not want or need any TCP connections with) in your firewall. There are simple solutions for that for most firewall’s.

And fail2ban as mentioned earlier.

tx7 · January 4, 2017, 5:47pm

SSH keys are protect from intruder access to server, not the NC login site.
NC should have a settings that allow admins to blacklist IP or number of failed attempts.