Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite

I am using an Aiport Extreme as my wireless router, and it has port forwarding set up but disabled for SSH: Screen shot of my configuration window The port forward settings sheet

However, I keep seeing instances of ssh login attempts from outside -- someone is trying to access my computer using a series of user names. Moreover, I can still log in from outside my home network using SSH, so I know it's open to the world.

How is this happening? How do I stop it?

Edit

Here is the log for a connection attempt:

==> /var/log/system.log <==
Apr 10 10:36:41: --- last message repeated 8 times ---
Apr 10 10:36:41 null-3 sandboxd[56246]: sshd(68515) deny mach-per-user-lookup

==> /var/log/secure.log <==
Apr 10 10:36:43 null-3 sshd[68516]: Invalid user presto from 124.124.91.195
share|improve this question
Can you post the log entry for one of the ssh attempts? – user5037 Apr 10 '11 at 16:30

3 Answers

up vote 1 down vote accepted

I am pretty sure when you select remote log in in the sharing preference pane, OS X opens the port on the router programmatically using NAT-PMP. Have you tried disabling that on the airport and rebooting?

Turn off NAT-PMP

Also be sure you are not editing a profile that is not active on the Airport. I have fallen into that trap once or twice every so often.

share|improve this answer
That'd be a pain; I have other services that use this. I'll have to experiment to see if that's the case. – Chris R Jun 9 '11 at 23:16
It's the answer to why - as you note, you could do it temporarily for testing to make sure it's the case. Then you can look into csc.liv.ac.uk/~greg/sshdfilter to cut off hosts that try to brute force your mac. – bmike♦ Jun 10 '11 at 0:05
I ended up installing sshdfilter. Thanks for the tip! – Chris R Jul 27 '11 at 13:47
up vote 0 down vote

I would turn off your remote access until you know your home network isn't public so that someone doesn't access it besides you.

share|improve this answer
No can do; I need ssh access to the machine, just not so much from outside. – Chris R Apr 10 '11 at 17:53
You may be able to set up password on your AirPort Extreme router, I know that many programs written for wireless connection require set passwords in order to attempt the connection you might be able to do the same. – luca590 Apr 11 '11 at 0:46
up vote 0 down vote

I am not familiar with the Airport Extreme admin but it looks like you have SSH remote login turned off in the first dialog, and then in the second dialog add it manually mapping external port 22 to internal ip 191.168.1.10 port 22. What you are seeing is someone (usually a script kiddie) trying a dictionary attack against your system.

If you must have ssh access then I would suggest running it on a non standard external port, which you map to the internal address and port 22. On Linux boxes to prevent this type of activity I normally install DenyHosts which seems to have a Mac port available. This monitors the logs of the ssh daemon, and adds the ip of any system that had a configurable number of failed login attempts within a time window to /etc/hosts.deny

share|improve this answer
The second screen shot is a detail of the first; it's the view of the disabled SSH setting in that dialog. – Chris R Apr 10 '11 at 23:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.