lucasburlingham.me

Map of (failed) SSH login attempts on my VPS

Imagine you host a couple websites and would rather not have to deal with them being defaced. They run a classic LAMP stack and are just Ubuntu Server boxes connected through a Cloudflare Tunnel. They aren't hardened outside of normal standards (disable ssh login to a couple IP's, don't expose any ports to the outside, has Fail2Ban installed & configured, etc). I check in on this VPS every couple months to make sure it's still operational and make sure automatic updates are still functioning properly. (Thanks cron!)

This particular VPS has an uptime of up 16 weeks, 1 day, 10 hours, 6 minutes at the time of this writing. Pretty good, I think. It's completely up to date and I haven't touched it in months.

The first thing I do when I login is verify that the last time anyone logged in was 1: from my IP address, 2: under my unprivilaged username (root cannot login) and 3: at a time that makes sense for me. If it's coming from a random IP, it's wrong, and if it's from another user, it's wrong.

The second thing I usually do is search the internet with a query along the lines of How to show all banned IP with fail2ban?, which of course instantly pulls up the same article I looked at the last time I logged in, which is a serverfault post asking the same question. It can be found here. I use this answer, which gives me a list in JSON. I redirect the output and process it like so:

fail2ban-client banned > badips		 // Get the list of banned IP's and put them into a file named badips
sed -i "s/[{'sshd': //g" badips		 // Remove the first part of the JSON
sed -i "s/]}]//g" badips			 // Remove the last part of the JSON
sed -i "s/'/\n/g" badips			 // Remove the single quotes
sed -i "s/,//g" badips				 // Remove the commas
sed -i "s/ /\n/g" badips			 // Replace the spaces with newlines
cat badips | uniq -d                 // If you get output, you have duplicates (you shouldn't have duplicates, but I check anyways)

This gives me a list of IP's to copy and take over to a bulk IP lookup service. I use ShowMyIP.com.

Paste them into the box (100 lines max) and click LOOKUP. You should get a map and a table outlining who each IP belongs to and where they are on a nice leaflet.js map.

Here's a screenshot of the map I generated:

Please note that this only shows the first 100 IP's I gave showmyip.com: if you look into the references for this article you'll find a download for the rest (totalling 1193!)

These IP's have been permenantly banned and any requests they make to my host will be dropped with IPTables. To set up system like this for yourself, please refer to the references section of this page.

References

• Download badips.txt
• DigitalOcean Tutorial How To Protect SSH with Fail2Ban on Ubuntu 20.04