can someone give me direction on this I've copied some of my logs in the area that looks suspicious to me. i can drop more in if im in the wrong area.

 

Jul  6 20:50:30 riptide  sshd[30525]: Connection from 192.168.1.113 port 51475 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:30 riptide  sshd[30525]: Invalid user  from 192.168.1.113 port 51475
Jul  6 20:50:30 riptide  sshd[30525]: Failed none for invalid user  from 192.168.1.113 port 51475 ssh2
Jul  6 20:50:30 riptide  sshd[30525]: Received disconnect from 192.168.1.113 port 51475:11:  [preauth]
Jul  6 20:50:30 riptide  sshd[30525]: Disconnected from invalid user  192.168.1.113 port 51475 [preauth]
Jul  6 20:50:30 riptide  sshd[30527]: Connection from 192.168.1.113 port 51476 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:30 riptide  sshd[30527]: Invalid user Admin from 192.168.1.113 port 51476
Jul  6 20:50:30 riptide  sshd[30527]: Failed none for invalid user Admin from 192.168.1.113 port 51476 ssh2
Jul  6 20:50:30 riptide  sshd[30527]: Received disconnect from 192.168.1.113 port 51476:11:  [preauth]
Jul  6 20:50:30 riptide  sshd[30527]: Disconnected from invalid user Admin 192.168.1.113 port 51476 [preauth]
Jul  6 20:50:30 riptide  sshd[30530]: Connection from 192.168.1.113 port 51477 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:30 riptide  sshd[30530]: Invalid user admin from 192.168.1.113 port 51477
Jul  6 20:50:30 riptide  sshd[30530]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:30 riptide  sshd[30530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:32 riptide  sshd[30530]: Failed password for invalid user admin from 192.168.1.113 port 51477 ssh2
Jul  6 20:50:32 riptide  sshd[30530]: Received disconnect from 192.168.1.113 port 51477:11:  [preauth]
Jul  6 20:50:32 riptide  sshd[30530]: Disconnected from invalid user admin 192.168.1.113 port 51477 [preauth]
Jul  6 20:50:32 riptide  sshd[30563]: Connection from 192.168.1.113 port 51486 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:32 riptide  sshd[30563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113  user=root
Jul  6 20:50:35 riptide  sshd[30563]: Failed password for root from 192.168.1.113 port 51486 ssh2
Jul  6 20:50:36 riptide  sshd[30563]: Received disconnect from 192.168.1.113 port 51486:11:  [preauth]
Jul  6 20:50:36 riptide  sshd[30563]: Disconnected from authenticating user root 192.168.1.113 port 51486 [preauth]
Jul  6 20:50:36 riptide  sshd[30626]: Connection from 192.168.1.113 port 51502 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:36 riptide  sshd[30626]: Invalid user user from 192.168.1.113 port 51502
Jul  6 20:50:36 riptide  sshd[30626]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:36 riptide  sshd[30626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:38 riptide  sshd[30626]: Failed password for invalid user user from 192.168.1.113 port 51502 ssh2
Jul  6 20:50:40 riptide  sshd[30626]: Received disconnect from 192.168.1.113 port 51502:11:  [preauth]
Jul  6 20:50:40 riptide  sshd[30626]: Disconnected from invalid user user 192.168.1.113 port 51502 [preauth]
Jul  6 20:50:40 riptide  sshd[30698]: Connection from 192.168.1.113 port 51508 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:40 riptide  sshd[30698]: Invalid user admin from 192.168.1.113 port 51508
Jul  6 20:50:40 riptide  sshd[30698]: Failed none for invalid user admin from 192.168.1.113 port 51508 ssh2
Jul  6 20:50:40 riptide  sshd[30698]: Received disconnect from 192.168.1.113 port 51508:11:  [preauth]
Jul  6 20:50:40 riptide  sshd[30698]: Disconnected from invalid user admin 192.168.1.113 port 51508 [preauth]
Jul  6 20:50:40 riptide  sshd[30700]: Connection from 192.168.1.113 port 51509 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:40 riptide  sshd[30700]: Invalid user sysadm from 192.168.1.113 port 51509
Jul  6 20:50:40 riptide  sshd[30700]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:40 riptide  sshd[30700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:42 riptide  sshd[30700]: Failed password for invalid user sysadm from 192.168.1.113 port 51509 ssh2
Jul  6 20:50:43 riptide  sshd[30700]: Received disconnect from 192.168.1.113 port 51509:11:  [preauth]
Jul  6 20:50:43 riptide  sshd[30700]: Disconnected from invalid user sysadm 192.168.1.113 port 51509 [preauth]
Jul  6 20:50:43 riptide  sshd[30740]: Connection from 192.168.1.113 port 51512 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:43 riptide  sshd[30740]: Invalid user admin from 192.168.1.113 port 51512
Jul  6 20:50:43 riptide  sshd[30740]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:43 riptide  sshd[30740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:46 riptide  sshd[30740]: Failed password for invalid user admin from 192.168.1.113 port 51512 ssh2
Jul  6 20:50:48 riptide  sshd[30740]: Received disconnect from 192.168.1.113 port 51512:11:  [preauth]
Jul  6 20:50:48 riptide  sshd[30740]: Disconnected from invalid user admin 192.168.1.113 port 51512 [preauth]
Jul  6 20:50:48 riptide  sshd[30851]: Connection from 192.168.1.113 port 51514 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:48 riptide  sshd[30851]: Invalid user  from 192.168.1.113 port 51514
Jul  6 20:50:48 riptide  sshd[30851]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:48 riptide  sshd[30851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:50 riptide  sshd[30851]: Failed password for invalid user  from 192.168.1.113 port 51514 ssh2
Jul  6 20:50:50 riptide  sshd[30851]: Received disconnect from 192.168.1.113 port 51514:11:  [preauth]
Jul  6 20:50:50 riptide  sshd[30851]: Disconnected from invalid user  192.168.1.113 port 51514 [preauth]
Jul  6 20:50:50 riptide  sshd[30908]: Connection from 192.168.1.113 port 51527 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:50 riptide  sshd[30908]: Invalid user meo from 192.168.1.113 port 51527
Jul  6 20:50:50 riptide  sshd[30908]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:50 riptide  sshd[30908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:53 riptide  sshd[30908]: Failed password for invalid user meo from 192.168.1.113 port 51527 ssh2
Jul  6 20:50:54 riptide  sshd[30908]: Received disconnect from 192.168.1.113 port 51527:11:  [preauth]
Jul  6 20:50:54 riptide  sshd[30908]: Disconnected from invalid user meo 192.168.1.113 port 51527 [preauth]
Jul  6 20:50:54 riptide  sshd[31069]: Connection from 192.168.1.113 port 51532 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:54 riptide  sshd[31069]: Invalid user admin from 192.168.1.113 port 51532
Jul  6 20:50:54 riptide  sshd[31069]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:54 riptide  sshd[31069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:56 riptide  sshd[31069]: Failed password for invalid user admin from 192.168.1.113 port 51532 ssh2
Jul  6 20:50:56 riptide  sshd[31069]: Received disconnect from 192.168.1.113 port 51532:11:  [preauth]
Jul  6 20:50:56 riptide  sshd[31069]: Disconnected from invalid user admin 192.168.1.113 port 51532 [preauth]
Jul  6 20:50:56 riptide  sshd[31137]: Connection from 192.168.1.113 port 51535 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:50:56 riptide  sshd[31137]: Invalid user guest from 192.168.1.113 port 51535
Jul  6 20:50:56 riptide  sshd[31137]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:50:56 riptide  sshd[31137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:50:59 riptide  sshd[31137]: Failed password for invalid user guest from 192.168.1.113 port 51535 ssh2
Jul  6 20:51:00 riptide  sshd[31137]: Received disconnect from 192.168.1.113 port 51535:11:  [preauth]
Jul  6 20:51:00 riptide  sshd[31137]: Disconnected from invalid user guest 192.168.1.113 port 51535 [preauth]
Jul  6 20:51:00 riptide  sshd[31283]: Connection from 192.168.1.113 port 51549 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:00 riptide  sshd[31283]: Invalid user admin from 192.168.1.113 port 51549
Jul  6 20:51:00 riptide  sshd[31283]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:51:00 riptide  sshd[31283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:51:02 riptide  sshd[31283]: Failed password for invalid user admin from 192.168.1.113 port 51549 ssh2
Jul  6 20:51:02 riptide  sshd[31283]: Received disconnect from 192.168.1.113 port 51549:11:  [preauth]
Jul  6 20:51:02 riptide  sshd[31283]: Disconnected from invalid user admin 192.168.1.113 port 51549 [preauth]
Jul  6 20:51:02 riptide  sshd[31371]: Connection from 192.168.1.113 port 51556 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:02 riptide  sshd[31371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113  user=root
Jul  6 20:51:05 riptide  sshd[31371]: Failed password for root from 192.168.1.113 port 51556 ssh2
Jul  6 20:51:05 riptide  sshd[31371]: Received disconnect from 192.168.1.113 port 51556:11:  [preauth]
Jul  6 20:51:05 riptide  sshd[31371]: Disconnected from authenticating user root 192.168.1.113 port 51556 [preauth]
Jul  6 20:51:05 riptide  sshd[31410]: Connection from 192.168.1.113 port 51574 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:05 riptide  sshd[31410]: Invalid user Admin from 192.168.1.113 port 51574
Jul  6 20:51:06 riptide  sshd[31410]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:51:06 riptide  sshd[31410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:51:07 riptide  sshd[31410]: Failed password for invalid user Admin from 192.168.1.113 port 51574 ssh2
Jul  6 20:51:08 riptide  sshd[31410]: Received disconnect from 192.168.1.113 port 51574:11:  [preauth]
Jul  6 20:51:08 riptide  sshd[31410]: Disconnected from invalid user Admin 192.168.1.113 port 51574 [preauth]
Jul  6 20:51:08 riptide  sshd[31473]: Connection from 192.168.1.113 port 51578 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:08 riptide  sshd[31473]: Invalid user Administrator from 192.168.1.113 port 51578
Jul  6 20:51:08 riptide  sshd[31473]: Failed none for invalid user Administrator from 192.168.1.113 port 51578 ssh2
Jul  6 20:51:08 riptide  sshd[31473]: Received disconnect from 192.168.1.113 port 51578:11:  [preauth]
Jul  6 20:51:08 riptide  sshd[31473]: Disconnected from invalid user Administrator 192.168.1.113 port 51578 [preauth]
Jul  6 20:51:08 riptide  sshd[31475]: Connection from 192.168.1.113 port 51579 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:09 riptide  sshd[31475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113  user=root
Jul  6 20:51:11 riptide  sshd[31475]: Failed password for root from 192.168.1.113 port 51579 ssh2
Jul  6 20:51:12 riptide  sshd[31475]: Received disconnect from 192.168.1.113 port 51579:11:  [preauth]
Jul  6 20:51:12 riptide  sshd[31475]: Disconnected from authenticating user root 192.168.1.113 port 51579 [preauth]
Jul  6 20:51:12 riptide  sshd[31517]: Connection from 192.168.1.113 port 51582 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:12 riptide  sshd[31517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113  user=root
Jul  6 20:51:14 riptide  sshd[31517]: Failed password for root from 192.168.1.113 port 51582 ssh2
Jul  6 20:51:15 riptide  sshd[31517]: Received disconnect from 192.168.1.113 port 51582:11:  [preauth]
Jul  6 20:51:15 riptide  sshd[31517]: Disconnected from authenticating user root 192.168.1.113 port 51582 [preauth]
Jul  6 20:51:15 riptide  sshd[31574]: Connection from 192.168.1.113 port 51585 on 192.168.1.116 port 22 rdomain ""
Jul  6 20:51:15 riptide  sshd[31574]: Invalid user ubnt from 192.168.1.113 port 51585
Jul  6 20:51:15 riptide  sshd[31574]: pam_unix(sshd:auth): check pass; user unknown
Jul  6 20:51:15 riptide  sshd[31574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.113 
Jul  6 20:51:17 riptide  sshd[31574]: Failed password for invalid user ubnt from 192.168.1.113 port 51585 ssh2
Jul  6 20:51:19 riptide  sshd[31574]: Received disconnect from 192.168.1.113 port 51585:11:  [preauth]
Jul  6 20:51:19 riptide  sshd[31574]: Disconnected from invalid user ubnt 192.168.1.113 port 51585 [preauth]
Jul  6 21:00:07 riptide  crond[1565]: exit status 1 from user root /usr/local/sbin/mover &> /dev/null
Jul  6 21:00:23 riptide root: /etc/libvirt: 23.7 MiB (24891392 bytes) trimmed on /dev/loop3
Jul  6 21:00:23 riptide root: /var/lib/docker: 8.7 GiB (9326219264 bytes) trimmed on /dev/loop2
Jul  6 21:00:23 riptide root: /mnt/cache: 20.2 GiB (21716492288 bytes) trimmed on /dev/sdr1
Jul  6 21:18:46 riptide  smbd[11333]: [2023/07/06 21:18:46.480747,  0] ../../source3/smbd/files.c:1199(synthetic_pathref)
Jul  6 21:18:46 riptide  smbd[11333]:   synthetic_pathref: opening [craig/DOWNFALL/Configuration/Catalog1.edb] failed
Jul  6 21:18:46 riptide  smbd[11333]: [2023/07/06 21:18:46.507637,  0] ../../source3/smbd/dfree.c:132(sys_disk_free)
Jul  6 21:18:46 riptide  smbd[11333]:   sys_disk_free: VFS disk_free failed. Error was : Not a directory
Jul  6 22:00:07 riptide  crond[1565]: exit status 1 from user root /usr/local/sbin/mover &> /dev/null
Jul  6 22:00:30 riptide root: /etc/libvirt: 23.7 MiB (24891392 bytes) trimmed on /dev/loop3
Jul  6 22:00:30 riptide root: /var/lib/docker: 8.7 GiB (9331982336 bytes) trimmed on /dev/loop2
Jul  6 22:00:30 riptide root: /mnt/cache: 22.2 GiB (23810883584 bytes) trimmed on /dev/sdr1
Jul  6 22:18:49 riptide  smbd[11333]: [2023/07/06 22:18:49.463913,  0] ../../source3/smbd/files.c:1199(synthetic_pathref)
Jul  6 22:18:49 riptide  smbd[11333]:   synthetic_pathref: opening [craig/DOWNFALL/Configuration/Catalog1.edb] failed
Jul  6 22:18:49 riptide  smbd[11333]: [2023/07/06 22:18:49.486904,  0] ../../source3/smbd/dfree.c:132(sys_disk_free)
Jul  6 22:18:49 riptide  smbd[11333]:   sys_disk_free: VFS disk_free failed. Error was : Not a directory
Jul  6 23:00:07 riptide  crond[1565]: exit status 1 from user root /usr/local/sbin/mover &> /dev/null
Jul  6 23:00:28 riptide root: /etc/libvirt: 23.7 MiB (24891392 bytes) trimmed on /dev/loop3
Jul  6 23:00:28 riptide root: /var/lib/docker: 8.7 GiB (9330675712 bytes) trimmed on /dev/loop2
Jul  6 23:00:28 riptide root: /mnt/cache: 21.6 GiB (23207026688 bytes) trimmed on /dev/sdr1
Jul  6 23:18:51 riptide  smbd[11333]: [2023/07/06 23:18:51.719753,  0] ../../source3/smbd/files.c:1199(synthetic_pathref)
Jul  6 23:18:51 riptide  smbd[11333]:   synthetic_pathref: opening [craig/DOWNFALL/Configuration/Catalog1.edb] failed
Jul  6 23:18:51 riptide  smbd[11333]: [2023/07/06 23:18:51.739664,  0] ../../source3/smbd/dfree.c:132(sys_disk_free)
Jul  6 23:18:51 riptide  smbd[11333]:   sys_disk_free: VFS disk_free failed. Error was : Not a directory

On Jul 6 there were 16 invalid login attempts. This could either be yourself attempting to login to your server (SSH / Telnet) with the wrong user or password, or you could be actively be the victim of hack attacks. A common cause of this would be placing your server within your routers DMZ, or improperly forwarding ports.

This is a major issue and needs to be addressed IMMEDIATELY

NOTE: Because this check is done against the logged entries in the syslog, the only way to clear it is to either increase the number of allowed invalid logins per day (if determined that it is not a hack attempt) or to reset your server. It is not recommended under any circumstance to ignore this error  More Information

17 hours ago, Downfall110 said:

192.168.1.113

Which computer/device is this?

that is apparently the computer i daily drive

 

 

Did you try some sort of system security/port scanner/etc. type of program recently?  The logins have Users that are some of the most common default Users.

no

Whatever the issue is coming from that computer, either you have a program doing scans like mentioned or it may be infected with something.

It's the private scan network vulnerability with Avast Security software.

I had the same logs when it was used on my network.

Edited December 13, 20232 yr by Gaiserik