Re: Connection closed by [IP] port [port] [preauth]

[steve <dlist@bluewin.ch>]

Le 24-02-2020, à 15:51:53 -0500, Dan Ritter a écrit :

> steve wrote:
> > Hi there,
> >
> > Since February 11th at 00:25:09, I am getting the following every 12
> > secondes:
> >
> > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port 54422 [preauth]
> >
> > And when I say every 12 seconds, it is really every 12 seconds, and this
> > is now going on for more than 13 days, without any interruption. At the
> > beginning, I thought that this was just standards nmap scans or
> > something similar and so didn't bother taking any action. But now I'm
> > asking myself who (in China) would be so stupid to continue this
> > scanning.
> >
> > What should I do? Send an email to the abuse contact? Ignore it and wait
> > that it's over? It doesn't seem naughty but it's getting irritating.
>
> sudo apt install iptables-persistent
> sudo iptables -A INPUT -s 118.126.105.120 -j DROP
> sudo netfilter-persistent save

Clean logs, thanks :)

Funny, right after issuing these commands, new IP started scanning my
system. Re-issued the commands and the problem was solved.

Thanks a lot.

S