Quote

Oct 27 22:23:23 DarkMoonServers login: pam_unix(remote:auth): check pass; user unknown
Oct 27 22:23:23 DarkMoonServers login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126
Oct 27 22:23:25 DarkMoonServers login: FAILED LOGIN 1 FROM 2.183.84.126 FOR admin, Authentication failure
Oct 27 22:23:28 DarkMoonServers login: pam_unix(remote:auth): check pass; user unknown
Oct 27 22:23:30 DarkMoonServers login: FAILED LOGIN 2 FROM 2.183.84.126 FOR admin, Authentication failure
Oct 27 22:23:34 DarkMoonServers in.telnetd[17373]: connect from 2.183.84.126 (2.183.84.126)
Oct 27 22:23:41 DarkMoonServers login: pam_unix(remote:auth): check pass; user unknown
Oct 27 22:23:41 DarkMoonServers login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126
Oct 27 22:23:43 DarkMoonServers login: FAILED LOGIN 1 FROM 2.183.84.126 FOR service, Authentication failure
Oct 27 22:23:43 DarkMoonServers login: pam_unix(remote:auth): check pass; user unknown
Oct 27 22:23:43 DarkMoonServers login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126
Oct 27 22:23:44 DarkMoonServers sshd[17434]: Connection from 209.141.60.103 port 57534 on 192.168.1.60 port 22 rdomain ""
Oct 27 22:23:44 DarkMoonServers sshd[17434]: Unable to negotiate with 209.141.60.103 port 57534: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 27 22:23:45 DarkMoonServers login: FAILED LOGIN 2 FROM 2.183.84.126 FOR admin, Authentication failure
Oct 27 22:23:47 DarkMoonServers login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126 user=root
Oct 27 22:23:48 DarkMoonServers login: FAILED LOGIN 3 FROM 2.183.84.126 FOR root, Authentication failure
Oct 27 22:23:52 DarkMoonServers login: FAILED LOGIN 4 FROM 2.183.84.126 FOR root, Authentication failure
Oct 27 22:23:54 DarkMoonServers login: FAILED LOGIN SESSION FROM 2.183.84.126 FOR root, Authentication failure
Oct 27 22:23:54 DarkMoonServers login: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126 user=root
Oct 27 22:23:55 DarkMoonServers in.telnetd[17504]: connect from 2.183.84.126 (2.183.84.126)
Oct 27 22:24:03 DarkMoonServers login: pam_unix(remote:auth): check pass; user unknown
Oct 27 22:24:03 DarkMoonServers login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/0 ruser= rhost=2.183.84.126
Oct 27 22:24:04 DarkMoonServers login: FAILED LOGIN 1 FROM 2.183.84.126 FOR Admin, Authentication failure

Iv noted my logs constantly going through this process. Can anyone help me figure out if something i should be concerned about, as im seeing a lot of login attempts that i dont know what the heck they are from especially from an SSH standpoint This is from the general log in unraid for whole system.

Your diagnostics might provide more information.

 

Is your Unraid administration interface open to the internet ?

What are your router rules for the server, is it in the DMZ ?

 

If so, you should stop that immediately.

 

I did have DMZ on for the server. I have disabled that. As far as ports that are open. Just some of the dockers I have for open ports such as game servers, but mostly everything else I keep to local items only. I do have a proxy setup with cloud flare for Nextcloud and Bitwarden but that’s really only servers I have. I appreciate the reply. As far as the interface goes I don’t see a setting anywhere for remote access but port 80 isn’t open.

1 hour ago, nikkinrob said:

I did have DMZ on for the server. I have disabled that. As far as ports that are open. Just some of the dockers I have for open ports such as game servers, but mostly everything else I keep to local items only. I do have a proxy setup with cloud flare for Nextcloud and Bitwarden but that’s really only servers I have. I appreciate the reply. As far as the interface goes I don’t see a setting anywhere for remote access but port 80 isn’t open.

My understanding is that any device that is in the DMZ is totally exposed to the Internet, no need to add rules. So your port 80 was probably visible, that would explain the attacks.