2

My Ubuntu server had recently problems with a bruteforce attack. So I installed fail2ban and I think the problem is gone.

But when I check iftop I see a Chinese IP permanently connecting.

iftop
                12.5Kb          25.0Kb          37.5Kb          50.0Kb    62.5Kb
mqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqqvqqqqqqqqqqqqqqq
Ubuntu-1510-wily-64-minim  => 218.201.37.134             4.22Kb  4.12Kb  4.13Kb
                           <=                            6.33Kb  6.19Kb  6.20Kb

qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
TX:             cum:    205KB   peak:   7.10Kb  rates:   5.38Kb  5.12Kb  5.32Kb
RX:                     233KB           8.37Kb           6.48Kb  6.34Kb  6.46Kb
TOTAL:                  438KB           15.5Kb           11.9Kb  11.5Kb  11.8Kb

Is this normal or do I have a problem.

There is only Teamspeak³ an Minecraft running on the server.

edit1:

lsof -i -n
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd       656 root    3u  IPv4  16856      0t0  TCP *:ssh (LISTEN)
sshd       656 root    4u  IPv6  16858      0t0  TCP *:ssh (LISTEN)
ts3server  898 root   32u  IPv4  17853      0t0  TCP *:30033 (LISTEN)
ts3server  898 root   33u  IPv6  17854      0t0  TCP *:30033 (LISTEN)
ts3server  898 root   34u  IPv4  16985      0t0  UDP myip:34773->194.97.114.3:2010
ts3server  898 root   39u  IPv4  17862      0t0  UDP *:9987
ts3server  898 root   40u  IPv6  17863      0t0  UDP *:9987
ts3server  898 root   45u  IPv4  17867      0t0  TCP *:10011 (LISTEN)
ts3server  898 root   46u  IPv6  17868      0t0  TCP *:10011 (LISTEN)
java      1050 root   46u  IPv6  20495      0t0  TCP *:25565 (LISTEN)
sshd      1220 root    3u  IPv4  21663      0t0  TCP *:1022 (LISTEN)
sshd      1220 root    4u  IPv6  21665      0t0  TCP *:1022 (LISTEN)
sshd      4347 root    3u  IPv4  55148      0t0  TCP myip:ssh->mysship:50031 (ESTABLISHED)

There are no logins (checked via last) that are not from me.

user207680
  • 21
  • 3
  • I'm unfamiliar with `iftop`. Is that really them connecting to you, or do you in fact connect to them? Could you use `lsof` to see what program on your machine is at your end of the connection? – Kusalananda Dec 29 '16 at 13:09
  • If you don't recognize the IP address, just do a manual block on that IP address so that the connection drops and then you can remove that rule. I would also make sure you're fully patched and to monitor logins to the machine. It would also be wortwhile to see what port they're connected to before you drop the connection. – Bratchley Dec 29 '16 at 14:56
  • @Bratchley I blocked the IP via `iptables -A INPUT -s 218.201.37.134 -j DROP` and see if something misbehaves. – user207680 Dec 29 '16 at 15:24
  • @user207680 the connection appears to be outbound. I'm not familiar with how teamspeak (the program that they're communicating with) works but there may be someone in China that's just trying to use it. If this isn't legitimate use, you might need to reconfigure something inside teamspeak to close whatever they're taking advantage of. – Bratchley Dec 29 '16 at 17:36

1 Answers1

1

Please, try such command:

netstat -n |grep 218.201.37.134
Taras
  • 111
  • 2