Community discussions

MikroTik App
 
carman
just joined
Topic Author
Posts: 2
Joined: Sun May 30, 2010 5:05 pm
Location: italia

unknown access attempts

Sun Jun 06, 2010 9:47 pm

Hello All,
This is the first time i write on this forum, I am not an expert but i can get by.
My problem is... after putting a public ip, i receive these access attempts through SSH.
Can anyone tell me what they are, and if it is possibile to block them.
Sorry for the english as it is not my language :-)
Thanks
Carlos
You do not have the required permissions to view the files attached to this post.
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6695
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Re: unknown access attempts

Mon Jun 07, 2010 11:07 am

There are multiple programs, which are trying to abuse your router with SSH login attempts.
Possible solution for the problem;
- setup firewall and allow SSH only for known IP addresses;
- setup address at /ip service field for SSH server (only one IP address/subnet is allowed there);
- set different port for SSH access.
 
he1ium
newbie
Posts: 36
Joined: Fri Aug 07, 2009 7:30 am

Re: unknown access attempts

Tue Jun 08, 2010 12:58 am

You could block after so many failed attempts in a certain time limit. This is posted in other forums -

add action=drop chain=input comment="drop ssh brute forcers" disabled=no \
dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=1w3d chain=input comment="" connection-state=new \
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m chain=input comment="" connection-state=new \
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
address-list-timeout=1m chain=input comment="" connection-state=new \
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
address-list-timeout=1m chain=input comment="" connection-state=new \
disabled=no dst-port=22 protocol=tcp
 
Stunherald
just joined
Posts: 21
Joined: Sun May 23, 2010 10:38 pm

Re: unknown access attempts

Tue Jun 08, 2010 3:42 am

Or just disable SSH on your RB if you don't need it.

IP -> Services -> Disable ssh

If you don't need any of these services, you should disable all of them except winbox and if you using web-interface, keep www enabled too.
 
carman
just joined
Topic Author
Posts: 2
Joined: Sun May 30, 2010 5:05 pm
Location: italia

Re: unknown access attempts

Tue Jun 08, 2010 3:44 pm

Thanks a lot folks, i followed your advice. I changed the port and resolved my problem.
:D
Carlos

Who is online

Users browsing this forum: Bing [Bot], eworm, mfischer and 109 guests