Attaque réseau ?

[manuloup]

Ah oui j'avais oublié ce détail. Il faut faire les modifs dans jail.local et non dans jail.conf.

J'ai corrigé dans mon tuto page 2, merci.

[jackslayter]

[Polo753]

Bonjour,
Apres avoir regarder Mister Robot, la parano c'est bien installer sans echec !
Donc je vois pas mal d'ip qui se co dans les log web de domoticz avec de temps en temps pas mal d’erreurs

2016-09-26 16:48:19.725 Incoming connection from: 122.228.215.3
2016-09-26 16:48:19.726 Error: Webserver: File '/script': No such file or directory (2)

Je suis donc tombé chez vous en cherchant comment sécuriser ma grotte...
Donc ...
J'ai un domoticz sur rasp 3 avec acces de l'exterieur en passant par no-ip et ma livebox ( tout fonctionne presque bien )
J'ai donc voulu suivre votre tuto pour fail2ban mais il a l'aire d'etre installer et configurer correctement avec la beta (je crois ...)
Et donc j'ai modifier le fichier pour les logs du post de vil1driver mais impossible de trouver le fichier domoticz.log dans /var/log/
Donc pas de ban d'ip tester en 3g ...

Jvous post mon auth.log

Code : Tout sélectionner

Sep 26 06:25:44 raspberrypi CRON[23877]: pam_unix(cron:session): session closed for user root
Sep 26 06:26:04 raspberrypi sshd[5770]: Received disconnect from 119.249.54.88: 11:  [preauth]
Sep 26 06:26:53 raspberrypi sshd[5782]: Received disconnect from 119.249.54.75: 11:  [preauth]
Sep 26 06:41:15 raspberrypi sshd[5930]: Received disconnect from 221.194.47.224: 11:  [preauth]
Sep 26 06:53:41 raspberrypi sshd[6058]: Did not receive identification string from 163.172.197.79
Sep 26 07:17:01 raspberrypi CRON[6293]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 07:17:01 raspberrypi CRON[6293]: pam_unix(cron:session): session closed for user root
Sep 26 07:49:31 raspberrypi sshd[6658]: Did not receive identification string from 212.129.21.142
Sep 26 07:49:31 raspberrypi sshd[6659]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:31 raspberrypi sshd[6659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142  user=root
Sep 26 07:49:33 raspberrypi sshd[6659]: Failed password for root from 212.129.21.142 port 61164 ssh2
Sep 26 07:49:33 raspberrypi sshd[6659]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:33 raspberrypi sshd[6665]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:33 raspberrypi sshd[6665]: Invalid user test from 212.129.21.142
Sep 26 07:49:33 raspberrypi sshd[6665]: input_userauth_request: invalid user test [preauth]
Sep 26 07:49:33 raspberrypi sshd[6665]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:33 raspberrypi sshd[6665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:35 raspberrypi sshd[6665]: Failed password for invalid user test from 212.129.21.142 port 61537 ssh2
Sep 26 07:49:35 raspberrypi sshd[6665]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:35 raspberrypi sshd[6671]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:35 raspberrypi sshd[6671]: Invalid user admin from 212.129.21.142
Sep 26 07:49:35 raspberrypi sshd[6671]: input_userauth_request: invalid user admin [preauth]
Sep 26 07:49:35 raspberrypi sshd[6671]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:35 raspberrypi sshd[6671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:38 raspberrypi sshd[6671]: Failed password for invalid user admin from 212.129.21.142 port 61687 ssh2
Sep 26 07:49:38 raspberrypi sshd[6671]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:38 raspberrypi sshd[6678]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:38 raspberrypi sshd[6678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142  user=root
Sep 26 07:49:40 raspberrypi sshd[6678]: Failed password for root from 212.129.21.142 port 62070 ssh2
Sep 26 07:49:40 raspberrypi sshd[6678]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:41 raspberrypi sshd[6684]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:41 raspberrypi sshd[6684]: Invalid user guest from 212.129.21.142
Sep 26 07:49:41 raspberrypi sshd[6684]: input_userauth_request: invalid user guest [preauth]
Sep 26 07:49:41 raspberrypi sshd[6684]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:41 raspberrypi sshd[6684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:42 raspberrypi sshd[6684]: Failed password for invalid user guest from 212.129.21.142 port 62234 ssh2
Sep 26 07:49:42 raspberrypi sshd[6684]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:43 raspberrypi sshd[6694]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:43 raspberrypi sshd[6694]: Invalid user ubnt from 212.129.21.142
Sep 26 07:49:43 raspberrypi sshd[6694]: input_userauth_request: invalid user ubnt [preauth]
Sep 26 07:49:43 raspberrypi sshd[6694]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:43 raspberrypi sshd[6694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:44 raspberrypi sshd[6694]: Failed password for invalid user ubnt from 212.129.21.142 port 62370 ssh2
Sep 26 07:49:44 raspberrypi sshd[6694]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:45 raspberrypi sshd[6704]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:45 raspberrypi sshd[6704]: Invalid user support from 212.129.21.142
Sep 26 07:49:45 raspberrypi sshd[6704]: input_userauth_request: invalid user support [preauth]
Sep 26 07:49:45 raspberrypi sshd[6704]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:45 raspberrypi sshd[6704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:46 raspberrypi sshd[6704]: Failed password for invalid user support from 212.129.21.142 port 62766 ssh2
Sep 26 07:49:46 raspberrypi sshd[6704]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:47 raspberrypi sshd[6710]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:47 raspberrypi sshd[6710]: Invalid user test from 212.129.21.142
Sep 26 07:49:47 raspberrypi sshd[6710]: input_userauth_request: invalid user test [preauth]
Sep 26 07:49:47 raspberrypi sshd[6710]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:47 raspberrypi sshd[6710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:49 raspberrypi sshd[6710]: Failed password for invalid user test from 212.129.21.142 port 62898 ssh2
Sep 26 07:49:49 raspberrypi sshd[6710]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:49 raspberrypi sshd[6716]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:50 raspberrypi sshd[6716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142  user=pi
Sep 26 07:49:52 raspberrypi sshd[6716]: Failed password for pi from 212.129.21.142 port 63305 ssh2
Sep 26 07:49:52 raspberrypi sshd[6716]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:52 raspberrypi sshd[6722]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:52 raspberrypi sshd[6722]: Invalid user admin from 212.129.21.142
Sep 26 07:49:52 raspberrypi sshd[6722]: input_userauth_request: invalid user admin [preauth]
Sep 26 07:49:52 raspberrypi sshd[6722]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:52 raspberrypi sshd[6722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:53 raspberrypi sshd[6722]: Failed password for invalid user admin from 212.129.21.142 port 63442 ssh2
Sep 26 07:49:53 raspberrypi sshd[6722]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:54 raspberrypi sshd[6728]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:54 raspberrypi sshd[6728]: Invalid user user from 212.129.21.142
Sep 26 07:49:54 raspberrypi sshd[6728]: input_userauth_request: invalid user user [preauth]
Sep 26 07:49:54 raspberrypi sshd[6728]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:54 raspberrypi sshd[6728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:56 raspberrypi sshd[6728]: Failed password for invalid user user from 212.129.21.142 port 63819 ssh2
Sep 26 07:49:56 raspberrypi sshd[6728]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:56 raspberrypi sshd[6734]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:56 raspberrypi sshd[6734]: Invalid user ftpuser from 212.129.21.142
Sep 26 07:49:56 raspberrypi sshd[6734]: input_userauth_request: invalid user ftpuser [preauth]
Sep 26 07:49:56 raspberrypi sshd[6734]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:56 raspberrypi sshd[6734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:49:58 raspberrypi sshd[6734]: Failed password for invalid user ftpuser from 212.129.21.142 port 63844 ssh2
Sep 26 07:49:58 raspberrypi sshd[6734]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:49:58 raspberrypi sshd[6740]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:49:58 raspberrypi sshd[6740]: Invalid user PlcmSpIp from 212.129.21.142
Sep 26 07:49:58 raspberrypi sshd[6740]: input_userauth_request: invalid user PlcmSpIp [preauth]
Sep 26 07:49:58 raspberrypi sshd[6740]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:49:58 raspberrypi sshd[6740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:50:00 raspberrypi sshd[6740]: Failed password for invalid user PlcmSpIp from 212.129.21.142 port 64386 ssh2
Sep 26 07:50:00 raspberrypi sshd[6740]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:50:00 raspberrypi sshd[6746]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:50:00 raspberrypi sshd[6746]: Invalid user admin from 212.129.21.142
Sep 26 07:50:00 raspberrypi sshd[6746]: input_userauth_request: invalid user admin [preauth]
Sep 26 07:50:00 raspberrypi sshd[6746]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:50:00 raspberrypi sshd[6746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:50:03 raspberrypi sshd[6746]: Failed password for invalid user admin from 212.129.21.142 port 64408 ssh2
Sep 26 07:50:03 raspberrypi sshd[6746]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:50:03 raspberrypi sshd[6752]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:50:03 raspberrypi sshd[6752]: Invalid user nagios from 212.129.21.142
Sep 26 07:50:03 raspberrypi sshd[6752]: input_userauth_request: invalid user nagios [preauth]
Sep 26 07:50:03 raspberrypi sshd[6752]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:50:03 raspberrypi sshd[6752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:50:05 raspberrypi sshd[6752]: Failed password for invalid user nagios from 212.129.21.142 port 64560 ssh2
Sep 26 07:50:05 raspberrypi sshd[6752]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:50:06 raspberrypi sshd[6758]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:50:06 raspberrypi sshd[6758]: Invalid user adam from 212.129.21.142
Sep 26 07:50:06 raspberrypi sshd[6758]: input_userauth_request: invalid user adam [preauth]
Sep 26 07:50:06 raspberrypi sshd[6758]: pam_unix(sshd:auth): check pass; user unknown
Sep 26 07:50:06 raspberrypi sshd[6758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142
Sep 26 07:50:08 raspberrypi sshd[6758]: Failed password for invalid user adam from 212.129.21.142 port 64975 ssh2
Sep 26 07:50:08 raspberrypi sshd[6758]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 07:50:08 raspberrypi sshd[6764]: reverse mapping checking getaddrinfo for 212-129-21-142.rev.poneytelecom.eu [212.129.21.142] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep 26 07:50:08 raspberrypi sshd[6764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.21.142  user=root
Sep 26 07:50:10 raspberrypi sshd[6764]: Failed password for root from 212.129.21.142 port 65124 ssh2
Sep 26 07:50:10 raspberrypi sshd[6764]: error: Received disconnect from 212.129.21.142: 3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Sep 26 08:17:01 raspberrypi CRON[7045]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 08:17:01 raspberrypi CRON[7045]: pam_unix(cron:session): session closed for user root
Sep 26 08:47:02 raspberrypi sshd[7371]: Received disconnect from 121.18.238.114: 11:  [preauth]
Sep 26 08:47:08 raspberrypi sshd[7374]: Received disconnect from 119.249.54.75: 11:  [preauth]
Sep 26 09:00:03 raspberrypi sshd[7507]: Received disconnect from 121.18.238.98: 11:  [preauth]
Sep 26 09:10:05 raspberrypi sshd[7611]: Received disconnect from 221.194.47.249: 11:  [preauth]
Sep 26 09:17:01 raspberrypi CRON[7683]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 09:17:01 raspberrypi CRON[7683]: pam_unix(cron:session): session closed for user root
Sep 26 10:17:01 raspberrypi CRON[8312]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 10:17:01 raspberrypi CRON[8312]: pam_unix(cron:session): session closed for user root
Sep 26 10:21:15 raspberrypi sshd[8375]: Received disconnect from 119.249.54.66: 11:  [preauth]
Sep 26 10:21:56 raspberrypi sshd[8387]: Received disconnect from 119.249.54.88: 11:  [preauth]
Sep 26 10:39:20 raspberrypi sshd[8560]: Received disconnect from 121.18.238.104: 11:  [preauth]
Sep 26 10:50:02 raspberrypi sshd[8673]: Received disconnect from 221.194.47.249: 11:  [preauth]
Sep 26 10:54:13 raspberrypi sshd[8716]: Received disconnect from 117.169.85.170: 11: Bye Bye [preauth]
Sep 26 11:17:01 raspberrypi CRON[8952]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 11:17:01 raspberrypi CRON[8952]: pam_unix(cron:session): session closed for user root
Sep 26 11:19:53 raspberrypi sshd[8999]: Did not receive identification string from 213.165.89.84
Sep 26 11:27:05 raspberrypi sshd[9077]: Did not receive identification string from 163.172.197.79
Sep 26 12:00:28 raspberrypi sshd[9412]: Received disconnect from 119.249.54.66: 11:  [preauth]
Sep 26 12:00:40 raspberrypi sshd[9421]: Received disconnect from 221.194.47.229: 11:  [preauth]
Sep 26 12:17:01 raspberrypi CRON[9591]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 12:17:01 raspberrypi CRON[9591]: pam_unix(cron:session): session closed for user root
Sep 26 13:09:50 raspberrypi sshd[10148]: Did not receive identification string from 113.108.21.16
Sep 26 13:17:01 raspberrypi CRON[10220]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 13:17:01 raspberrypi CRON[10220]: pam_unix(cron:session): session closed for user root
Sep 26 13:18:44 raspberrypi sshd[10265]: Received disconnect from 121.18.238.109: 11:  [preauth]
Sep 26 13:20:42 raspberrypi sshd[10287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89-97-55-33.ip16.fastwebnet.it  user=root
Sep 26 13:20:44 raspberrypi sshd[10287]: Failed password for root from 89.97.55.33 port 39866 ssh2
Sep 26 13:20:46 raspberrypi sshd[10287]: Failed password for root from 89.97.55.33 port 39866 ssh2
Sep 26 13:20:46 raspberrypi sshd[10287]: Received disconnect from 89.97.55.33: 11: disconnected by user [preauth]
Sep 26 13:20:46 raspberrypi sshd[10287]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89-97-55-33.ip16.fastwebnet.it  user=root
Sep 26 13:36:56 raspberrypi sshd[10456]: Received disconnect from 221.194.47.249: 11:  [preauth]
Sep 26 13:41:22 raspberrypi sshd[10505]: fatal: Unable to negotiate a key exchange method [preauth]
Sep 26 14:17:01 raspberrypi CRON[10866]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 14:17:01 raspberrypi CRON[10866]: pam_unix(cron:session): session closed for user root
Sep 26 15:06:09 raspberrypi sshd[11388]: Received disconnect from 221.194.47.229: 11:  [preauth]
Sep 26 15:12:18 raspberrypi sshd[11456]: Received disconnect from 119.249.54.75: 11:  [preauth]
Sep 26 15:17:01 raspberrypi CRON[11503]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 15:17:02 raspberrypi CRON[11503]: pam_unix(cron:session): session closed for user root
Sep 26 15:25:50 raspberrypi sshd[11617]: Received disconnect from 121.18.238.109: 11:  [preauth]
Sep 26 15:41:20 raspberrypi sshd[11776]: Received disconnect from 221.194.47.249: 11:  [preauth]
Sep 26 16:06:51 raspberrypi sudo:     root : TTY=unknown ; PWD=/home/pi/domoticz ; USER=root ; COMMAND=/usr/sbin/service domoticz.sh stop
Sep 26 16:06:51 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 26 16:07:22 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 16:07:37 raspberrypi sudo:     root : TTY=unknown ; PWD=/home/pi/domoticz ; USER=root ; COMMAND=/usr/sbin/service domoticz.sh start
Sep 26 16:07:37 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Sep 26 16:07:37 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 16:17:01 raspberrypi CRON[12264]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 26 16:17:01 raspberrypi CRON[12264]: pam_unix(cron:session): session closed for user root
Sep 26 17:00:16 raspberrypi sshd[12725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=polo-pc.home  user=pi
Sep 26 17:00:18 raspberrypi sshd[12725]: Failed password for pi from 192.168.1.27 port 51973 ssh2
Sep 26 17:00:24 raspberrypi sshd[12725]: Accepted password for pi from 192.168.1.27 port 51973 ssh2
Sep 26 17:00:24 raspberrypi sshd[12725]: pam_unix(sshd:session): session opened for user pi by (uid=0)
Sep 26 17:00:24 raspberrypi sshd[12725]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Sep 26 17:00:24 raspberrypi sshd[12725]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Sep 26 17:00:36 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/bin/nano /tmp/domoticz.txt
Sep 26 17:00:36 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Sep 26 17:00:42 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 17:01:14 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/bin/nano /var/log/domoticz.log
Sep 26 17:01:14 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Sep 26 17:01:17 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 17:01:37 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/bin/nano /etc/fail2ban/
Sep 26 17:01:37 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Sep 26 17:01:57 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 17:05:16 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/bin/nano /etc/fail2ban/jail.local
Sep 26 17:05:16 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Sep 26 17:06:27 raspberrypi sshd[12725]: pam_unix(sshd:session): session closed for user pi
Sep 26 17:06:27 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 17:06:39 raspberrypi sshd[12904]: Accepted password for pi from 192.168.1.27 port 52051 ssh2
Sep 26 17:06:39 raspberrypi sshd[12904]: pam_unix(sshd:session): session opened for user pi by (uid=0)
Sep 26 17:06:39 raspberrypi sshd[12904]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Sep 26 17:06:39 raspberrypi sshd[12904]: lastlog_openseek: Couldn't stat /var/log/lastlog: No such file or directory
Sep 26 17:06:47 raspberrypi sudo:       pi : TTY=pts/0 ; PWD=/home/pi ; USER=root ; COMMAND=/usr/bin/nano var/log/auth.log
Sep 26 17:06:47 raspberrypi sudo: pam_unix(sudo:session): session opened for user root by pi(uid=0)
Sep 26 17:06:59 raspberrypi sudo: pam_unix(sudo:session): session closed for user root
Sep 26 17:12:09 raspberrypi sshd[13028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=polo-pc.home  user=pi
Sep 26 17:12:11 raspberrypi sshd[13028]: Failed password for pi from 192.168.1.27 port 52113 ssh2
Sep 26 17:12:18 raspberrypi sshd[13028]: Accepted password for pi from 192.168.1.27 port 52113 ssh2
Sep 26 17:12:18 raspberrypi sshd[13028]: pam_unix(sshd:session): session opened for user pi by (uid=0)

Si je dechiffre bien la plus part n'arrivent pas a se connecter avec user mais la session root est utiliser ?

Je n'y connais pas grand chose en linux, je suis les tutos trouver sur le net pour bidouiller mon rasp

Des idées pour m'en sortir ?

[vil1driver]

T'as ouvert un accès ssh sur le port par défaut 22 ?
Très mauvaise idée
Fermes ça de suite ! C'est le premier reflex à avoir..

[Polo753]

Non j'ai rien ouvert volontairement...
J'utilise le ssh en local je pensais pas qu'il était aussi accessible depuis l’extérieure !
Dans tout les cas j'ai formater la sd et désactiver no-ip pour ne plus avoir acces de l’extérieure

[vil1driver]

No-ip c'est pour faire le lien entre ton ip externe et un nom de domaine, le supprimer n'empêchera pas d'accéder à ton pi, formater la carte non plus puisque ssh est activé par défaut.

Vérifie les paramètres de ta box, ta protection c'est elle..

[manuloup]

Si tu veux laisser ton accès ssh en externe, c'est possible mais :

- installe fail2ban et mets un ban de plusieurs heures dès 3 tentatives. Vu le nombre de combinaisons tu es tranquille
- retire l'accès en root directement par ssh via le sshd_config
- change le port externe 22 pour un port plus "exotique" de ton choix (au-delà de 1000)

Si tu fais cela, tu es tranquille et élimines 99 % des risques.

Manu

[Polo753]

Ma livebox n'est plus connecter a no-ip et ne redirige plus les ports ... Et celle ci a changer d'ip au dernier redemarrage, le rasp ne devrait plus etre accessible nan ?
Pour le fail2ban, il ne marche pas avec moi a cause du fichier domoticz.log qui est inexistant...
Pour le reste il faut que je me renseigne,je sais pas faire !
Jvais aller me cherche quelques tuto pour sécuriser mon ssh et refaire les autres avec cette nouvelle installe !

Merci pour vos conseilles

[manuloup]

Pour le fichier domotiz.log inexistant, tu peux corriger ça dans ton script de démarrage de domoticz :

Dans le fichier /etc/init.d/domoticz.sh tu changes :

Code : Tout sélectionner

DAEMON_ARGS="$DAEMON_ARGS -log /var/log//domoticz.log"

puis tu relances domoticz :

Code : Tout sélectionner

sudo /etc/init.d/domoticz.sh restart

[manuloup]

Voilà, j'ai ajouté la partie concernant le domoticz.log dans mon tuto page 2.