FreeNAS security question ..

[Bernard Mentink]

Hi All,

I am wondering on some entries in the regular security emails I get. I have this entry:

Code:

freenas.local login failures:
Apr  9 19:23:43 freenas sshd[25868]: Bad protocol version identification 'a' from 71.6.142.85 port 35557

Is this someone trying to hack my server? Should I ban that IP in my firewall? It happens nearly every day ..

 

[m0nkey_]

In an ideal world, your FreeNAS server should not be accessible to the outside world.

 

[Bernard Mentink]

I only have ssh access ... because it is NOT an ideal world :) .. actually in an ideal world, you would not need security at all.
I guess I could ssh into a Jail, but not sure how more secure that would be .. would be good to get an answer for my question though ..

 

[Jailer]

Did you change your SSH port to a non standard port? If not you should, it will stop those kinds of access attempts.

 

[Bernard Mentink]

Yes, I did. But the person at the IP above is banging on a different port completely to my open one ...
Won't stop these type of attacks if he is using a port scanner ...

 

[Ericloewe]

Yes, I did. But the person at the IP above is banging on a different port completely to my open one ...
Won't stop these type of attacks if he is using a port scanner ...

No, that's his port. IP connections are identified by the IP addresses and ports of both endpoints. Clients just generally open a random port in an unreserved range and use that, hence the "port 35557" bit.

 

[Vito Reiter]

Alright, well the IP you listed actually appears on some blacklists and should probably be added to yours. If you're the only one that really accesses FreeNAS, or there's only like two people in your company that can use it (like mine), I would turn SSH off until you need to use it. Block all connections to your NAS box from the outside world (Simple router settings), and do your best to make sure that access to it is limited.

Also, someone once told me "If someone wants to get in bad enough, they will. Doesn't matter how much security you have". I use some basic blacklists on our network and add to them as I see necessary. You'll slowly notice that no matter how small a person or company you are, someone will try to get in because someone's data is always valuable to them.