SSH connection attempt

aaP_ludovic.leonis

Hello,
I receive telegram notifications every night indicating SSH connection attempts each time between midnight and 1am.

I have no script running at this time. I can't find anything in the journalctl, and I can't find anything in /var/log/auth.log either

I also blocked port 22 on the firewall, so this is not a remote attempt.

I don't know where to look to find the cause of the bad connections

aaP_ludovic.leonis

the telegram notif is :

SSH login failure alarm >Server:aaPanel Linux panel >IPAddress: IP Server(Internet) IP Server(Internal) >SendingTime: 2024-12-24 00:18:55 >Notification type: SSH login failure alarm >Content of alarm: Login failed more than 30 times in 1 minutes

aaPanel_Kern

Hello, can I view the login log?
You can try to use Security --> Brute force protection to enable SSH protection

aaP_ludovic.leonis

Hello,
Which log do you want to see?
Thank you

aaPanel_Kern

SSH login logs
aaP_ludovic.leonis

aaP_ludovic.leonis

Hello,

The IP 82.64.xxx.xxx is my IP. Even if I turn off my box, I still have connection attempts that continue. 🙁

Thank you.

aaPanel_Jose

aaP_ludovic.leonis
You can check the SSH logs to see if there are any records of these connections. Or you can try changing the SSH port to see if there are any connection records.

aaP_ludovic.leonis

Hello,
changing the port did nothing.
The lines remain the same and are really updated every second. However, for this I do not have an alert via telegram. Is it normal not to see more than the 7 lines present? Why do I not see the lines of the attempts that there are during the night and for which I receive telegram alerts?
Thank's

aaPanel_Kern

Hello, I suggest you modify the ssh port and ask if anyone else is trying to log in to your system.

aaP_ludovic.leonis