0

Sorry if this might be a noob question because I'm not very familiar with Pis or Linux in general. So I just recently set up my Pi 3 B with Raspbian and did an update this evening after not using it for about 2 months. Then I randomly went to check auth.log and discovered a weird IP trying to SSH into my Pi (turned out to be french and belong to Cyberghost-Servers-Paris) with various usernames:

Jan 19 19:59:17 raspberrypi sshd[2264]: Invalid user xbian from 185.156.173.55
Jan 19 19:59:17 raspberrypi sshd[2264]: input_userauth_request: invalid user xbian [preauth]
Jan 19 19:59:17 raspberrypi sshd[2264]: pam_unix(sshd:auth): check pass; user unknown
Jan 19 19:59:17 raspberrypi sshd[2264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.156.173.55
Jan 19 19:59:18 raspberrypi sshd[2264]: Failed password for invalid user xbian from 185.156.173.55 port 49199 ssh2
Jan 19 19:59:18 raspberrypi sshd[2264]: Received disconnect from 185.156.173.55: 11: Bye Bye [preauth]

Here's more: http://pastebin.com/ZAD4BdjN

Is this supposed to happen or should I be worried?

Note: I changed the default password so there's little chance of actually logging in but I'm still worried.

2

If this Pi is accessible from the Open Internet you'll get these. They are likely just random, try-it-on attacks. Check out Fail-2-ban, Linode have a guide, use the Debian section for a simple preventative measure. If you want to be more secure, disable SSH passwords and use Public key Auth instead. This will prevent people just guessing your password, again linode and digital ocean offer fair guides for this but just searching should give you plenty of guidance on hardening SSH.

If you are not on the open Internet, you need to investigate how someone is getting past your Gateway / Router and directly talking to the Pi. Check your port forwarding rules if so to see if someone can make contact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.