I set up my Raspberry a few weeks ago. Currently I just use it as an SSH server until I find the time to do something more interesting with it.
The Raspberry runs a sshd server and is connected to my home router. My router forwards a port (not 22, something different) to port 22 on the Raspberry. I disabled password authentication for the SSH server and set up a private/public key authentication. Also, my router updates my (dynamic) home IP address to some sort of dynamic DNS service.
So that's my setup, and it works.
What bothers me: I just checked my /var/log/auth.log file and noticed some strange entries. First of all, every hour I get an entry like this one:
CRON[31837]: pam_unix(cron:session): session opened for user root by (uid=0)
CRON[31837]: pam_unix(cron:session): session closed for user root
Even though I have no cronjobs running (sudo crontab -e
is empty, so is crontab -e
for the pi-user). Is this normal?
Then, I noticed some other entries with unknown (not mine) IP addresses:
Jan 4 sshd[29395]: Connection closed by xx.xx.xx.xx [preauth]
Jan 5 sshd[30658]: Received disconnect from xx.xx.xx.xx: 11: disconnect [preauth]
Jan 7 sshd[31634]: Bad protocol version identification '\026\003\001' from xx.xx.xx.xx port xxxxx
Jan 7 sshd[31635]: Bad protocol version identification 'GET //a2billing HTTP/1.1' from xx.xx.xx.xx port xxxx
Do I have to worry that someone is trying to access my Raspberry? Or is this completely normal for an SSH server that is connected to the internet? Are there any things I should do to improve the security?