ssh attempts on non-ssh port
Is this just seeing the attempts even though there is no way to actually use those ports?
Example:
Mar 28 23:18:30 ulterius sshd[18292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.228.245.151 user=root
Mar 28 23:18:31 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:33 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:35 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:37 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:39 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
IPtables are not setup to allow a connection to SSH on port 3355. So any attempt would be denied. but the first line seems to have me wondering if it is still getting though?
# Allow SSH connections
# The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 2222 -j ACCEPT
is the section in my IPtables related to ssh.