Tengo 3 servidores CentOS configurados para mis aplicaciones. Recientemente reconocí que hay tantos ataques a mis servidores. Tengo tantos registros sobre el intento de iniciar sesión en mis servidores utilizando sshd de direcciones IP desconocidas.
Esto es parte de mi registro seguro:
May 25 03:45:03 mail sshd[22291]: Invalid user user from 42.121.117.150
May 25 03:45:03 mail sshd[22303]: input_userauth_request: invalid user user
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:03 mail sshd[22291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:03 mail sshd[22291]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:05 mail sshd[22291]: Failed password for invalid user user from 42.121.117.150 port 59430 ssh2
May 25 03:45:05 mail sshd[22303]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:07 mail sshd[22563]: Invalid user user from 42.121.117.150
May 25 03:45:07 mail sshd[22564]: input_userauth_request: invalid user user
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:07 mail sshd[22563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:07 mail sshd[22563]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:09 mail sshd[22563]: Failed password for invalid user user from 42.121.117.150 port 59655 ssh2
May 25 03:45:09 mail sshd[22564]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:11 mail sshd[22565]: Invalid user user1 from 42.121.117.150
May 25 03:45:11 mail sshd[22566]: input_userauth_request: invalid user user1
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:11 mail sshd[22565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:11 mail sshd[22565]: pam_succeed_if(sshd:auth): error retrieving information about user user1
May 25 03:45:13 mail sshd[22565]: Failed password for invalid user user1 from 42.121.117.150 port 59861 ssh2
May 25 03:45:13 mail sshd[22566]: Received disconnect from 42.121.117.150: 11: Bye Bye
May 25 03:45:15 mail sshd[22570]: Invalid user user from 42.121.117.150
May 25 03:45:15 mail sshd[22571]: input_userauth_request: invalid user user
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): check pass; user unknown
May 25 03:45:15 mail sshd[22570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.121.117.150
May 25 03:45:15 mail sshd[22570]: pam_succeed_if(sshd:auth): error retrieving information about user user
May 25 03:45:17 mail sshd[22570]: Failed password for invalid user user from 42.121.117.150 port 60107 ssh2
...
May 30 05:28:20 mail sshd[29998]: Failed password for root from 219.138.135.68 port 45105 ssh2
May 30 05:28:21 mail sshd[30273]: Failed password for root from 219.138.135.68 port 53227 ssh2
May 30 05:28:21 mail sshd[30266]: Failed password for root from 219.138.135.68 port 51786 ssh2
May 30 05:28:21 mail unix_chkpwd[30296]: password check failed for user (root)
May 30 05:28:21 mail unix_chkpwd[30297]: password check failed for user (root)
May 30 05:28:21 mail sshd[30280]: Failed password for root from 219.138.135.68 port 55313 ssh2
May 30 05:28:22 mail unix_chkpwd[30298]: password check failed for user (root)
...
May 31 11:12:38 mail sshd[2461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:40 mail sshd[2461]: Failed password for root from 211.233.60.37 port 48375 ssh2
May 31 11:12:40 mail sshd[2462]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:45 mail unix_chkpwd[2671]: password check failed for user (root)
May 31 11:12:45 mail sshd[2669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:47 mail sshd[2669]: Failed password for root from 211.233.60.37 port 48619 ssh2
May 31 11:12:47 mail sshd[2670]: Received disconnect from 211.233.60.37: 11: Bye Bye
May 31 11:12:50 mail unix_chkpwd[2675]: password check failed for user (root)
May 31 11:12:50 mail sshd[2673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.233.60.37 user=root
May 31 11:12:52 mail sshd[2673]: Failed password for root from 211.233.60.37 port 48905 ssh2
May 31 11:12:53 mail sshd[2674]: Received disconnect from 211.233.60.37: 11: Bye Bye
...
¿Cómo puedo bloquear este tipo de ataques a mi servidor? Tengo iptables instalado en mi servidor y todos los puertos (excepto mis necesidades) se rechazan dentro de él.