3

Just typed netstat and found this:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0    304 raspberrypi.home:ssh    MY_IP.dyn:18748 ESTABLISHED
tcp        0      0 raspberrypi.home:ssh    MY_IP.dyn:57789 ESTABLISHED
tcp        0      0 raspberrypi.home:ssh    43.255.190.187:45947    ESTABLISHED
Active UNIX domain sockets (w/o servers)
...

here MY_IP is my IP address. But also, there is this IP: 43.255.190.187

What does it mean? Is another person connected to my pi?

1
  • 1
    As per my answer, ESTABLISHED refers to the state of the TCP connection. It may indicate someone trying to log in to the ssh server, but it does not mean that they have succeeded in doing so. – goldilocks Apr 7 '15 at 10:49
4

An ESTABLISHED connection does not indicate anything about the state of things with regard to the ssh protocol; it refers to the state of the connection with regard to the TCP protocol.

Networking protocols are layered, and before anything ssh related can occur, a TCP connection must first be established; then ssh negotiations can occur. In order for you to be able to access the ssh server on the pi, you must leave port 22 open to the world. You can put some restrictions on this from the TCP side via iptables.

Port 22 is the common ssh port and every public facing sshd server using this port will report numbers of failed access attempts per day from bots crawling around looking for people who have not secured their server properly. Presuming you have (you mention a strong password), this is simply a nuisance in the logs. If you want to get rid of that, just use a different port instead of 22. That is not protection from anything, because if someone wants to attack your ssh server specifically, they will be able to find it by port scanning. However, the random bots will not bother -- they will just find port 22 closed and give up; port scanning it a relatively expensive task when you are making very long shots to start with.

To have an ssh access attempt fail, you must first have an ESTABLISHED TCP connection. Again, this does not indicate this is a fully logged in connection. It may, but it would also indicate someone trying to log in.

sudo grep "43.255.190.187" /var/log/auth.log

Will show you the record of the failed attempt(s). Of course, those could be faked if someone logged in as root and edited that file, but if you are using a strong password or secure keys assume they did not. That IP is on the ssh list from www.blocklist.de today together with a bunch of similar addresses that trace back to Hong Kong. They've probably tried tens of thousands of randomly found ssh ports for vulnerabilities in the past 24 hours, and they've probably been doing so for years; the purpose of those lists is so you can blacklist them to get rid of the nuisance in the logs.

But they are only a threat if you do have sshd configured in some completely foolish way, in which case your pi becomes a sleeper in some potential zombie network (that's just a guess -- methinks this is not a weapon they will find that useful).

I disagree with Ghanima's point about disabling root logins, by the way -- if someone has your root credentials and can log in as someone else, they can just su and it amounts to the same thing. My recommendation is password locked public/private keys, but that's just a preference; as you point out, a 16-byte password is too hard to break to make brute force worthwhile.

2
  • 1
    Still it's common advice to do so. After all I sets up another bar (however low that might be) to guess a valid user name for the system which might be enough to scare the bots away. I am however not claiming that it protects a system with weak passphrases for either non-priv or the privileged users. – Ghanima Apr 7 '15 at 10:55
  • @Ghanima Yeah, you're right -- I wouldn't say it's a bad opinion, just not one I share. I don't like password logins at all, whereas other people will claim justifiably there's nothing wrong with them. If being paranoid doesn't cost you too much, you might as well be paranoid with sshd. So if you're okay with disallowing root logins, go ahead. I was just trying to indicate that it is not completely foolish or unconventional to allow them, and that not allowing them obviously won't prevent someone from logging in and gaining root access. – goldilocks Apr 7 '15 at 11:06
1

A Reverse DNS service can't resolve that address so you'd have to assume the worst.

Have you changed the pi password to a decent long (16+ characters) password with a mixture of symbols?

7
  • Yeah, my password looks really random and 16+ characters, bruteforce would take sextillion years according to that site. Also, I've searched for ssh log and found that this IP has been trying to log all day long but without success. He tried the user root but in the raspberry it is pi. So I think it appeared on the netstat because this IP is trying to connect every second... But it never did a sucess login at ssh. Am I rigth? – magnuto Apr 7 '15 at 8:10
  • 1
    root access should definitely be disabled over ssh! Did you? – Ghanima Apr 7 '15 at 8:15
  • I'm not familiar with the ins and outs of ssh but ESTABLISHED sounds like a link has been created. Do you need to be connected to the internet? – joan Apr 7 '15 at 8:18
  • @joan yeam, i'm travelling. ESTABILISHED means a tcp connection estabilished, rigth? The log never show'd a connection done for the SSH for this ip. It just shows this IP trying all day to log on root, which does not exists. Its pi... – magnuto Apr 7 '15 at 8:19
  • Also I got a new line: tcp 0 720 raspberrypi.home:ssh KD106168249251.pp:44339 ESTABLISHED what does KD106168249251.pp means??? this isn't even an IP address :c – magnuto Apr 7 '15 at 8:31
1

After making sure that the system is not compromised:

Disable root access via ssh by putting the following line in /etc/ssh/sshd_config:

PermitRootLogin no

The rationale to do so is obviously the omnipotence an attacker gains if he gets access and also the fact that root itself is a user present at all unixoid system thous making it the first guess for anyone to try (whereas say magunto is not). You should always log in via ssh using a non-privileged user and assume rootprivileges only as needed by su or sudo.

It's also good advice to set up a tool like sshguard to prevent your networked host from obvious brute force attacks by blocking the attacker with a firewall rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.