SSH: dozens of unauthorized access attempts failed

[babuja]

Hi guys, just noticed several dozens of qnap access attempts failed via SSH.

What is this and best practices for security.

For now i have disabled ssh.

Sent from my Nexus 6P using Tapatalk

[dolbyman]

get your nas out of the open web (port forwarding)

why expose ssh ? of course bots will try to hack you

[babuja]

get your nas out of the open web (port forwarding)

why expose ssh ? of course bots will try to hack you

For educational propode only, i was trying to ssh my qnap from the wlan.


Sent from my Nexus 6P using Tapatalk

[P3R]

For educational propode only...

There is nothing wrong with having ssh enabled. In fact it's dangerous not to have ssh enabled as you have now. In a failure situation ssh may be your only way to access and save the NAS.

The problem here is that you have ssh open from the internet.

i was trying to ssh my qnap from the wlan.

There's no need to open ssh towards the internet for that. Disable all port forwarding in the router to the NAS unless absolutely necessary.

[babuja]

For educational propode only...

There is nothing wrong with having ssh enabled. In fact it's dangerous not to have ssh enabled as you have now. In a failure situation ssh may be your only way to access and save the NAS..

ssh enabled and port 22 closed

The problem here is that you have ssh open from the internet.

i was trying to ssh my qnap from the wlan.

There's no need to open ssh towards the internet for that. Disable all port forwarding in the router to the NAS unless absolutely necessary.

All ports closed except 443 for https access, 465 for gmail notifications



Sent from my Nexus 6P using Tapatalk

[P3R]

All ports closed except 443 for https access, 465 for gmail notifications

Then I would guess you have bad neighbours accessing your wlan or a compromised system within your network being remotely controlled by someone on the outside. Check the System Connection Logs and see what ip address it is that's trying to gain ssh access to the NAS. If you haven't enabled ssh logging under Options you need to do that first.

[babuja]

All ports closed except 443 for https access, 465 for gmail notifications

Then I would guess you have bad neighbours accessing your wlan or a compromised system within your network being remotely controlled by someone on the outside. Check the System Connection Logs and see what ip address it is that's trying to gain ssh access to the NAS. If you haven't enabled ssh logging under Options you need to do that first.

Initially i had 22 opened and ssh enabled...when i noticed access attempts i disabled ssh and closed port 22. All blocked access came from ssh connection attempts by port 22 (at that time opened). Now i have ssh enabled but port 22 closed.

Sent from my Nexus 6P using Tapatalk

[P3R]

Okay, then you should be good with ssh.

But you probably have logon attempts on 443 as well. Do you really need to have that open? If it's only a cool thing, then I would close it as well. Having a compromised NAS is very uncool.

[babuja]

Okay, then you should be good with ssh.

But you probably have logon attempts on 443 as well. Do you really need to have that open? If it's only a cool thing, then I would close it as well. Having a compromised NAS is very uncool.

I use 443 to https access qnap from wlan. Never had any 443 port access attempt. I guess i clould close it and access qnap from myqnapcloud, right?

Thanks P3R

Sent from my Nexus 6P using Tapatalk

[P3R]

I use 443 to https access qnap from wlan.

Again, accessing services from your wlan shouldn't require any port forwarding at all.

If it does your wlan must be on the outside of the firewall/router. If so why?

465 for gmail notifications

465 is an SMTP port so why are you port forwarding that? Or are you talking about outgoing ports?

If you want advice you need to clarify what router/firewall you have, what port forwarding or firewall rules you have in place and where this wlan is in relation to your lan.

[babuja]

I use 443 to https access qnap from wlan.

Again, accessing services from your wlan shouldn't require any port forwarding at all.

If it does your wlan must be on the outside of the firewall/router. If so why?

465 for gmail notifications

465 is an SMTP port so why are you port forwarding that? Or are you talking about outgoing ports?

If you want advice you need to clarify what router/firewall you have, what port forwarding or firewall rules you have in place and where this wlan is in relation to your lan.

Sorry P3R, i meant outside de wlan, my mistake.

Not required port forward on wlan or lan, only to access qnap when outside the lan/wlan.

That why 443 is port forward for https access qnap.

Regarding

Port 465 also port forwarded on my router...i used to have no gmail notifications and after some testing I've tried port forward port 465 and it worked.

Ip that tried to ssh access my qnap is from china...a big Hiiii for you from Angola

Sent from my Nexus 6P using Tapatalk

[babuja]

My router port 465 port forwarding settings

Sent from my Nexus 6P using Tapatalk

[P3R]

Port 465 also port forwarded on my router...i used to have no gmail notifications and after some testing I've tried port forward port 465 and it worked.

That makes absolutely no sense to me. As far as I know Gmail is an email client that regularly polls the server. No incoming ports should be required. Notifications should be a local issue on the client.

What is 192.168.1.4 on your network?

[babuja]

Port 465 also port forwarded on my router...i used to have no gmail notifications and after some testing I've tried port forward port 465 and it worked.

That makes absolutely no sense to me. As far as I know Gmail is an email client that regularly polls the server. No incoming ports should be required. Notifications should be a local issue on the client.

What is 192.168.1.4 on your network?

192.168.1.4 is qnap
If i disable port forward 465 qnap gmail notifications are dead, zero...not sure why.

Sent from my Nexus 6P using Tapatalk

[OneCD]

Sorry P3R, i meant outside de wlan, my mistake.

Not required port forward on wlan or lan, only to access qnap when outside the lan/wlan.

• LAN = (L)ocal (A)rea (N)etwork - your home or office on the 'private' side of your router.
• WLAN = (W)ireless (L)ocal (A)rea (N)etwork - your WiFi network on the 'private' side of your router.
• WAN = (W)ide (A)rea (N)etwork - for most people, this is the Internet on the 'public' side of your router.