My Notes: security

Showing posts with label security. Show all posts

Sunday, February 11, 2024

Openssl s_client to verify SSL

Syntax general: openssl s_client [-connect host:port] [option]

Get and read openssl s_client output

$ echo "Get HTTP/1.0" | openssl s_client google.com:443
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1                       <- verification chain 2 ok
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1                       <- verification chain 1 ok
depth=0 CN = *.google.com
verify return:1                       <- verification chain 0 ok
---
Certificate chain
0 s:CN = *.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 9 06:25:08 2024 GMT; NotAfter: Apr 2 06:25:07 2024 GMT
1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug 13 00:00:42 2020 GMT; NotAfter: Sep 30 00:00:42 2027 GMT
2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
... <TRUNCATED> ...
-----END CERTIFICATE-----
subject=CN = *.google.com
issuer=C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6833 bytes and written 396 bytes
Verification: OK                   <- handshake verification ok
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Use openssl s_client to export certificate PEM into a file (output file: certfs.pem)

$ echo "Get HTTP/1.0" | openssl s_client -showcerts -connect google.com:443 </dev/null | sed -n -e '/-.BEGIN/,/-.END/ p' > certifs.pem
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = *.google.com
verify return:1
DONE

Get fingerprint SHA1 in byte

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin

Fingerprint SHA256 in byte

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin

Fingerprint SHA256 in base64 encode

To get service sertificates

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com.com:443 -showcerts

For Let's Encrypt, here is official information about compatibility platforms (operating system, browser and java virtual machine, <link>

Reference:

https://www.openssl.org/docs/man1.0.2/man1/openssl-s_client.html
https://www.baeldung.com/linux/ssl-certificates

Monday, January 29, 2024

huawei echolife default user for EG & HG series

There are 3 default type/user group available in echolife EG, HG and DSL Home Gateway series, these user name and password are:

type/user group	EG Series	HG V300R016C10 and earlier	HG V300R017C00 and later	DSL Home Gateway
user	Epuser/userEp	root/admin	root/adminHW	user/HuaweiUser
admin	Epadmin/adminEp	root/admin *	root/adminHW *	user/HuaweiUser *
telnet	Eproot/adminEp	root/admin *	root/adminHW *	user/HuaweiUser *

* not tested

if those fail try telecomadmin/admintelecom or admin/@HuaweiHgw or maybe your firmware has been customized by your privder

user: for general use
admin: for more setting then user e.q to change default ntp and time zone; change services
telnet: for connect to router via telnet or SSH

In EG8145V5 default service to access your router are:

Enable the LAN-side PC to access the device using HTTP
Enable devices on the Wi-Fi side to access web pages

Important:

Change default password immediately and put in a note
DO NOT OPEN ANY SERVICES for WAN

References: https://forum.huawei.com/enterprise/en/huawei-ont-login-account-and-password/thread/667238610795118592-667213871523442688

Sunday, January 21, 2018

Detecting DNS flood using dns-flood-detector

You need to install dns-flood-detector
# apt-get install dns-flood-detector

dns-flood-detector will give you warning in dmesg something like:
[1309426.142779] TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies. Check SNMP counters.

To show where it is come from
# /etc/init<dot>d/dns-flood-detector status
* dns-flood-detector<dot>service - LSB: start and stop the dns-flood-detector daemon
Loaded: loaded (/etc/init<dot>d/dns-flood-detector; generated; vendor preset: enabled)
Active: active (running) since Fri 2018-01-05 14:25:46 WIB; 2 weeks 1 days ago
Docs: man:systemd-sysv-generator(8)
Tasks: 2 (limit: 4915)
CGroup: /system<dot>slice/dns-flood-detector<dot>service
`-475 /usr/bin/dns-flood-detector -d -v -v -t5 -w3
Jan 20 18:09:20 mars dns_flood_detector[475]: source [66<dot>220<dot>156<dot>144] - 3 tc…AA]
Jan 20 18:09:23 mars dns_flood_detector[475]: source [173<dot>252<dot>90<dot>118] - 3 tc…AA]
Warning: Journal has been rotated since unit was started<dot> Log output is incomplete or unavailable<dot>
Hint: Some lines were ellipsized, use -l to show in full<dot>

or
# service dns-flood-detector status
* dns-flood-detector<dot>service - LSB: start and stop the dns-flood-dete
ctor daemon
Loaded: loaded (/etc/init<dot>d/dns-flood-detector; generated; vendor preset: ena
bled)
Active: active (running) since Fri 2018-01-05 14:25:46 WIB; 2 week
s 1 days ago
Docs: man:systemd-sysv-generator(8)
Tasks: 2 (limit: 4915)
CGroup: /system<dot>slice/dns-flood-detector<dot>service
`-475 /usr/bin/dns-flood-detector -d -v -v -t5 -w3
Jan 20 18:09:20 mars dns_flood_detector[475]: source [66<dot>220<dot>156<dot>144] -
3 tcp qps : 3 udp qps [1 qps A] [5 qps AAAA]
Jan 20 18:09:23 mars dns_flood_detector[475]: source [173<dot>252<dot>90<dot>118] -
3 tcp qps : 3 udp qps [1 qps A] [5 qps AAAA]
Warning: Journal has been rotated since unit was started<dot> Log output is incomple
te or unavailable<dot>

Lets we find out who they are
# whois 66<dot>220<dot>156<dot>144
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=66<dot>220<dot>156<dot>144?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange: 66<dot>220<dot>144<dot>0 - 66<dot>220<dot>159<dot>255
CIDR: 66<dot>220<dot>144<dot>0/20
NetName: TFBNET3
NetHandle: NET-66-220-144-0-1
Parent: NET66 (NET-66-0-0-0-0)
NetType: Direct Assignment
OriginAS: AS32934
Organization: Facebook, Inc<dot> (THEFA-3)
RegDate: 2009-02-13
Updated: 2012-02-24
Ref: https://whois<dot>arin<dot>net/rest/net/NET-66-220-144-0-1
...

and
# whois 173<dot>252<dot>90<dot>118
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=173<dot>252<dot>90<dot>118?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange: 173<dot>252<dot>64<dot>0 - 173<dot>252<dot>127<dot>255
CIDR: 173<dot>252<dot>64<dot>0/18
NetName: FACEBOOK-INC
NetHandle: NET-173-252-64-0-1
Parent: NET173 (NET-173-0-0-0-0)
NetType: Direct Assignment
OriginAS: AS32934
Organization: Facebook, Inc<dot> (THEFA-3)
RegDate: 2011-02-28
Updated: 2012-02-24
Ref: https://whois<dot>arin<dot>net/rest/net/NET-173-252-64-0-1

Ops they are Facebook.inc :D

Lets we block it
# ipset add mynetrules 66<dot>220<dot>156<dot>144
# ipset add mynetrules 173<dot>252<dot>90<dot>118
# iptables -L | grep mynetrules
DROP all -- anywhere anywhere match-set mynetrules src

These are how to block class C
Jan 21 10:11:31 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>119] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>125] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>126] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>123] - 3 t…AA]

Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>124] - 3 t…AA]

Just check one of them
# whois 173<dot>252<dot>124<dot>124
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=173<dot>252<dot>124<dot>124?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange: 173<dot>252<dot>64<dot>0 - 173<dot>252<dot>127<dot>255
CIDR: 173<dot>252<dot>64<dot>0/18
NetName: FACEBOOK-INC
NetHandle: NET-173-252-64-0-1
Parent: NET173 (NET-173-0-0-0-0)
NetType: Direct Assignment
OriginAS: AS32934
Organization: Facebook, Inc<dot> (THEFA-3)
RegDate: 2011-02-28
Updated: 2012-02-24
Ref: https://whois<dot>arin<dot>net/rest/net/NET-173-252-64-0-1

Lets we block it
# ipset add mynetrules 173<dot>252<dot>124<dot>0/24

Friday, May 26, 2017

Blocking IP by country for some ports using ipset

To block IP by country, we need IP blocks for particular country. This step needs IP blocks from http://ipdeny.com/.
We need to convert IP blocks into ipset format, this bash script will do:

Download block ip by country from http://www.ipdeny.com
Convert block ip into ipset format

For IPV4: http://www.ipdeny.com/ipblocks/data/countries/ For IPV6: http://www.ipdeny.com/ipv6/ipaddresses/blocks/
Here is bash script blockcountryip.sh or download from https://garasiku.web.id/ipset/blockcountryip.sh.txt:
#!/bin/bash
# 2017-05-23

if [ "$1" != "" ]; then
echo $1
# download ipv4 block
echo "Download ipv4 $1"
wget http://www.ipdeny.com/ipblocks/data/countries/$1.zone -O zone.ipv4.$1
# download ipv6 block
echo "Download ipv6 $1"
wget http://www.ipdeny.com/ipv6/ipaddresses/blocks/$1.zone -O zone.ipv6.$1
mfile1="./zone.ipv4.$1"
ofile1="./ipv4.ipset.$1"
touch $ofile1
echo "creating ipset rules $ofile1 for ipv4"
echo "create ipv4_$1 hash:net" > $ofile1
while read line; do
echo "add ipv4_$1 $line" >> $ofile1
done <"$mfile1"
echo "Done creating $ofile1"
mfile2="./zone.ipv6.$1"
ofile2="./ipv6.ipset.$1"
echo "creating ipset rules $ofile2 for ipv6"
echo "create ipv6_$1 hash:net" > $ofile2
while read line; do
echo "add ipv6_$1 $line" >> $ofile2
done <"$mfile2"
echo "Done creating $ofile2"
else
echo "Usage .//blockcountryip.sh countrycode2"
fi
To use this bash script:
# ./blockcountryip.sh [countrycode]
for example to generate IP blocks for China CN
# ./blockcountryip.sh cn
Note: you can download IP block for China from this http://garasiku.web.id/ipset/ipv4.ipset.cn with some additional IP block.
To load it in memory
# ipset restore -! < ipv4.ipset.[countrycode]
[countrycode] is 2 character country code https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
To apply in iptables
# iptables -A INPUT -p tcp -m multiport --dports [any port you wish] -m set --match-set ipv4_[countrycode] src -j DROP
For example to block all IPV4 from China for port 21, 22, 80, 443 and 2222
# iptables -A INPUT -p tcp -m multiport --dports 21,22,80,443,2222 -m set --match-set ipv4_cn src -j DROP
# iptables -A INPUT -p udp -m multiport --dports 22,2222 -m set --match-set ipv4_cn src -j DROP
Who will care if I block all of their connection:
# iptables -A INPUT -m set --match-set ipv4_cn src -j DROP
To make it persistent, follow your distribution guide how to load ipset and iptables rules every time system start/restart or network start/restart.
Not Working IPV6
Note:

Tunneling SSH may used UDP protocol
Proftpd listen on port 2222
Port 25 uses to communicate with/to other mail server

My github.com: https://github.com/dedetok/bash-block-ip-by-country
References:

Tuesday, November 15, 2016

Fail2ban: save your log into mysql and show it

Required:

fail2ban 0.9
mysql
web server with php (apache with php and mysql library)

Create user and its database in mysql. Give all privilege to its database for its user. You can use any existing database, here is only sample of database structures:
database name : myf2b
table name: kci_logipv4

No	field	datatype
1	logdate	datetime
2	logipv4	int(11)
3	logmsg	varchar(1000)
4	kci_category	int(11)
5	id	(int11)
6	codecontinent	char(2)
7	codecontinent2	char(2)
8	codecontinent3	char(3)

table name: kci_category

No	field	datatype
1	id	int(11)
2	category	varchar(20)

Note:

We store IPv4 in long.
Field with underline is primary key

Table kci_logipv4 will be used to store any log from trapped in fail2ban, and table kci_category will be used to categorize all log in type of attack. Populate kci_category with your wish, this is my category for example:

id	category
10	SSH
20	FTP
30	HTTP/HTTPS
40	SMTP/POP/IMAP/POP3/S

We need a small application to store any log trapped in fail2ban. I use PHP to do that. Here is kci_log.php source code https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/kci_log.php
That's all. Now you create a custom action mlocaldb.conf for fail2ban to call kci_log.php. Put mlocaldb.conf in /etc/fail2ban/action.d/, here is mlocaldb.conf https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/mlocaldb%2Cconf
Note: You need to change this part 'http://[your_domain]/kci_log.php' >> /home/[user]/logs/curlfail2ban.log

'http://[your_domain]/kci_log.php' where kci_log.php reside
/home/[user]/logs/curlfail2ban.log where the log will be store. You can remove it after you confidence.

The final step, edit your /etc/fail2ban/jail.conf and add a line to use mlocaldb at the end of action, for example:
...
[sshd]

port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[name=sshd]
mlocaldb[category=10]
abuseipdb[category=4,18,22]
...
Note change category with id you inserted into table kci_category. For example 20 for proftpd.
Show it in your web. This is kci_logread.php source code to show the log, feel free to modify it . https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/kci_logread.php

See on Github https://github.com/dedetok/fail2ban-to-mysql

Thursday, October 27, 2016

Script Kiddies to use hydra

This is intended for Education purpose!

After researching how to defend our network, I want to share how to perform what they are doing. It is very easy to perform automatic password attack against various services. One of their tools is hydra. Chrome mark https://www.thc.org/ "The site ahead contains harmful programs" and Firefox mark it as "Reported Unwanted Software Page!". Who's care.... LOL

To install it

`# apt-get install hydra`

or

`# yum install hydra`

To create dictionary install British words

`# apt-get install wbritish`

or

`# yum install words`

You don't need to run this as root.

Create a directory (whatever you want). I use directory hydra.

`$ mkdir hydra`
`$ cd hydra`

Now create words file before running hydra.

`$ cat /usr/share/dict/words > words.txt`

You can perform ssh using

`hydra -l root -P words.txt ssh://xxx.xxx.xxx.xxx`

To get more option:

`$ hydra -h`

`Hydra v8.0 (c) 2014 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes.`

`Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvVd46] [service://server[:PORT][/OPT]]`

`Options:`

`-R restore a previous aborted/crashed session`

`-S perform an SSL connect`

`-s PORT if the service is on a different default port, define it here`

`-l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE`

`-p PASS or -P FILE try password PASS, or load several passwords from FILE`

`-x MIN:MAX:CHARSET password bruteforce generation, type "-x -h" to get help`

`-e nsr try "n" null password, "s" login as pass and/or "r" reversed login`

`-u loop around users, not passwords (effective! implied with -x)`

`-C FILE colon separated "login:pass" format, instead of -L/-P options`

`-M FILE list of servers to attack, one entry per line, ':' to specify port`

`-o FILE write found login/password pairs to FILE instead of stdout`

`-f / -F exit when a login/pass pair is found (-M: -f per host, -F global)`

`-t TASKS run TASKS number of connects in parallel (per host, default: 16)`

`-w / -W TIME waittime for responses (32s) / between connects per thread`

`-4 / -6 prefer IPv4 (default) or IPv6 addresses`

`-v / -V / -d verbose mode / show login+pass for each attempt / debug mode`

`-q do not print messages about connection erros`

`-U service module usage details`

`server the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)`

`service the service to crack (see below for supported protocols)`

`OPT some service modules support additional input (-U for module help)`

`Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp`

`Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL`

`v3.0. The newest version is always available at http://www.thc.org/thc-hydra`

`Don't use in military or secret service organizations, or for illegal purposes.`

`These services were not compiled in: sapr3 afp ncp oracle.`

`Use HYDRA_PROXY_HTTP or HYDRA_PROXY - and if needed HYDRA_PROXY_AUTH - environment for a proxy setup.`

`E.g.: % export HYDRA_PROXY=socks5://127.0.0.1:9150 (or socks4:// or connect://)`

`% export HYDRA_PROXY_HTTP=http://proxy:8080`

`% export HYDRA_PROXY_AUTH=user:pass`

`Examples:`

`hydra -l user -P passlist.txt ftp://192.168.0.1`

`hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN`

`hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5`

`hydra -l admin -p password ftp://[192.168.0.0/24]/`

`hydra -L logins.txt -P pws.txt -M targets.txt ssh`

WARNING: FOR EDUCATION PURPOSE! DO IT ON YOUR LOCAL NETWORK AND WITH YOUR OWN RISK. DOING THIS IS ON PUBLIC NETWORK IS BREAKING A LAW!

Tuesday, October 25, 2016

fail2ban: autoreporting attack to www.abuseipdb.com

Create file /etc/fail2ban/action.d/abuseipdb.conf
# Fail2Ban configuration file
#
# Author: IGAM Muliarsa
#
#

# Action to report IP address to abuseipdb.com
# you must sign up in https://www.abuseipdb.com
# This action requires API_KEY
# https://www.abuseipdb.com/report/json?key=[API_KEY]&category=[CATEGORIES]&comment=[COMMENT]&ip=[IP]
#
# IMPORTANT:
#
# Reporting an IP of abuse is a serious complaint. Make sure that it is
# serious. Fail2ban developers and network owners recommend you only use this
# action for:
#   * The recidive where the IP has been banned multiple times
#   * Where maxretry has been set quite high, beyond the normal user typing
#     password incorrectly.
#   * For filters that have a low likelyhood of receiving human errors
#

[Definition]

# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
# Values: CMD
#
actionstart =

# Option: actionstop
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD
#
actionstop =

# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
actioncheck =

# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values: CMD
#

actionban
 = curl --data 'key=<apikey>' --data 'category=<category>' 
--data 'ip=<ip>' --data-urlencode 'comment=<matches>' 
--user-agent 'fail2ban v0.8.12' 'https://www.abuseipdb.com/report/json'

# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values: CMD
#
actionunban =

[Init]

# Option: apikey
# Notes    your user apikey from abuseipdb.com user account
# Values: STRING Default: None
#
apikey = REPLACE_WITH_YOUR_API_KEY

# Option: service
# Notes    service name you are reporting on, typically aligns with filter name
# Values: STRING Default: None
#
#service =
Edit /etc/fail2ban/jail.conf
...
[sshd]

port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[]
        mlocaldb[category=10]
        abuseipdb[category=4,18,22]
...
To find available category, follow this rule.
Restart your fail2ban.
Tested on Fail2ban 0.9.x

References:

https://www.abuseipdb.com/api.html

Tuesday, October 11, 2016

China DDOS SSH 2016-10-11 Involving 12 IPs

Log:
Oct 10 21:18:22 mars sshd[11737]: Bad protocol version identification 'test' from 183.129.160.229 port 50149
Oct 10 21:32:00 mars sshd[14650]: Received disconnect from 124.232.156.78: 11: Bye Bye [preauth]

Oct
 11 01:28:56 mars sshd[29033]: fatal: no matching cipher found: client 
aes128-cbc,blowfish-cbc,3des-cbc server 
aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com [preauth]

Oct 11 03:05:36 mars sshd[16159]: Did not receive identification string from 113.108.21.16
Oct 11 04:40:43 mars sshd[2440]: Received disconnect from 121.18.238.114: 11: [preauth]
Oct 11 04:43:11 mars sshd[2477]: Received disconnect from 119.249.54.75: 11: [preauth]
Oct 11 04:44:12 mars sshd[2482]: Received disconnect from 221.194.47.208: 11: [preauth]
Oct 11 04:45:11 mars sshd[2886]: Received disconnect from 221.194.47.229: 11: [preauth]
Oct 11 04:45:45 mars sshd[3419]: Received disconnect from 221.194.47.224: 11: [preauth]
Oct 11 04:52:32 mars sshd[4427]: Received disconnect from 221.194.47.249: 11: [preauth]
Oct 11 04:53:53 mars sshd[4433]: Received disconnect from 121.18.238.98: 11: [preauth]
Oct 11 04:56:15 mars sshd[5350]: Received disconnect from 119.249.54.68: 11: [preauth]
Oct 11 04:57:21 mars sshd[5384]: Received disconnect from 221.194.47.208: 11: [preauth]
Oct 11 04:57:52 mars sshd[5387]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 04:58:10 mars sshd[5390]: Received disconnect from 221.194.47.229: 11: [preauth]
Oct 11 05:02:36 mars sshd[6364]: Received disconnect from 221.194.47.249: 11: [preauth]
Oct 11 05:08:11 mars sshd[7341]: Received disconnect from 221.194.47.249: 11: [preauth]
Oct 11 05:09:53 mars sshd[7399]: Received disconnect from 119.249.54.68: 11: [preauth]
Oct 11 05:16:53 mars sshd[9285]: Received disconnect from 121.18.238.109: 11: [preauth]
Oct 11 05:18:51 mars sshd[9323]: Received disconnect from 119.249.54.75: 11: [preauth]
Oct 11 05:18:54 mars sshd[9325]: Received disconnect from 121.18.238.114: 11: [preauth]
Oct 11 05:25:45 mars sshd[11293]: Received disconnect from 221.194.47.224: 11: [preauth]
Oct 11 05:26:41 mars sshd[11297]: Received disconnect from 119.249.54.66: 11: [preauth]
Oct 11 05:29:04 mars sshd[11335]: Received disconnect from 221.194.47.229: 11: [preauth]
Oct 11 05:30:10 mars sshd[11717]: Received disconnect from 119.249.54.66: 11: [preauth]
Oct 11 05:31:35 mars sshd[12252]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 05:37:35 mars sshd[13232]: Received disconnect from 221.194.47.229: 11: [preauth]
Oct 11 05:40:48 mars sshd[14251]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 05:47:08 mars sshd[15236]: Received disconnect from 119.249.54.88: 11: [preauth]
Oct 11 05:51:46 mars sshd[16208]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 05:54:15 mars sshd[16266]: Received disconnect from 119.249.54.88: 11: [preauth]
Oct 11 05:57:01 mars sshd[17206]: Received disconnect from 121.18.238.98: 11: [preauth]
Oct 11 06:13:24 mars sshd[20155]: Connection closed by 221.194.47.208 [preauth]
Oct 11 06:16:53 mars sshd[21101]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 06:34:57 mars sshd[24362]: Received disconnect from 121.18.238.114: 11: [preauth]
Oct 11 06:40:53 mars sshd[26291]: Received disconnect from 119.249.54.68: 11: [preauth]
Oct 11 06:41:43 mars sshd[26296]: Received disconnect from 119.249.54.75: 11: [preauth]
Oct 11 06:41:58 mars sshd[26299]: Received disconnect from 221.194.47.249: 11: [preauth]
Oct 11 06:50:14 mars sshd[27709]: Received disconnect from 121.18.238.98: 11: [preauth]
Oct 11 07:55:39 mars sshd[8437]: Received disconnect from 119.249.54.88: 11: [preauth]
Oct 11 08:01:33 mars sshd[9618]: Received disconnect from 221.194.47.208: 11: [preauth]
Oct 11 08:03:14 mars sshd[9627]: Received disconnect from 121.18.238.104: 11: [preauth]
Oct 11 08:04:00 mars sshd[9632]: Received disconnect from 119.249.54.75: 11: [preauth]
Oct 10 21:18:22 mars sshd[11737]: Bad protocol version identification 'test' from 183.129.160.229 port 50149
Oct 10 21:32:00 mars sshd[14650]: Received disconnect from 124.232.156.78: 11: Bye Bye [preauth]

Oct
 11 01:28:56 mars sshd[29033]: fatal: no matching cipher found: client 
aes128-cbc,blowfish-cbc,3des-cbc server 
aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com [preauth]

119.249.54.66
119.249.54.68
119.249.54.75
119.249.54.88
121.18.238.104
121.18.238.109
121.18.238.114
121.18.238.98
221.194.47.208
221.194.47.224
221.194.47.229
221.194.47.249

Others IPs before attact begin:

113.108.21.16
Oct 11 03:05:36 mars sshd[16159]: Did not receive identification string from 113.108.21.16
124.232.156.78
Oct 10 21:32:00 mars sshd[14650]: Received disconnect from 124.232.156.78 : 11: Bye Bye [preauth]
183.129.160.229
Oct 11 03:05:36 mars sshd[16159]: Did not receive identification string from 113.108.21.16

Sequence for each IP attempt:

No	Time	From	Method Auth	No	Time	From	Method Auth
1	2016-10-11 4:40	121.18.238.114	: 11: [preauth]	21	2016-10-11 5:30	119.249.54.66	: 11: [preauth]
2	2016-10-11 4:43	119.249.54.75	: 11: [preauth]	22	2016-10-11 5:31	121.18.238.104	: 11: [preauth]
3	2016-10-11 4:44	221.194.47.208	: 11: [preauth]	23	2016-10-11 5:37	221.194.47.229	: 11: [preauth]
4	2016-10-11 4:45	221.194.47.229	: 11: [preauth]	24	2016-10-11 5:40	121.18.238.104	: 11: [preauth]
5	2016-10-11 4:45	221.194.47.224	: 11: [preauth]	25	2016-10-11 5:47	119.249.54.88	: 11: [preauth]
6	2016-10-11 4:52	221.194.47.249	: 11: [preauth]	26	2016-10-11 5:51	121.18.238.104	: 11: [preauth]
7	2016-10-11 4:53	121.18.238.98	: 11: [preauth]	27	2016-10-11 5:54	119.249.54.88	: 11: [preauth]
8	2016-10-11 4:56	119.249.54.68	: 11: [preauth]	28	2016-10-11 5:57	121.18.238.98	: 11: [preauth]
9	2016-10-11 4:57	221.194.47.208	: 11: [preauth]	29	2016-10-11 6:13	221.194.47.208	[preauth]
10	2016-10-11 4:57	121.18.238.104	: 11: [preauth]	30	2016-10-11 6:16	121.18.238.104	: 11: [preauth]
11	2016-10-11 4:58	221.194.47.229	: 11: [preauth]	31	2016-10-11 6:34	121.18.238.114	: 11: [preauth]
12	2016-10-11 5:02	221.194.47.249	: 11: [preauth]	32	2016-10-11 6:40	119.249.54.68	: 11: [preauth]
13	2016-10-11 5:08	221.194.47.249	: 11: [preauth]	33	2016-10-11 6:41	119.249.54.75	: 11: [preauth]
14	2016-10-11 5:09	119.249.54.68	: 11: [preauth]	34	2016-10-11 6:41	221.194.47.249	: 11: [preauth]
15	2016-10-11 5:16	121.18.238.109	: 11: [preauth]	35	2016-10-11 6:50	121.18.238.98	: 11: [preauth]
16	2016-10-11 5:18	119.249.54.75	: 11: [preauth]	36	2016-10-11 7:55	119.249.54.88	: 11: [preauth]
17	2016-10-11 5:18	121.18.238.114	: 11: [preauth]	37	2016-10-11 8:01	221.194.47.208	: 11: [preauth]
18	2016-10-11 5:25	221.194.47.224	: 11: [preauth]	38	2016-10-11 8:03	121.18.238.104	: 11: [preauth]
19	2016-10-11 5:26	119.249.54.66	: 11: [preauth]	39	2016-10-11 8:04	119.249.54.75	: 11: [preauth]
20	2016-10-11 5:29	221.194.47.229	: 11: [preauth]

It is better to block those IP in block /24:
For iptables:
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 119.249.54.0/24 -j DROP
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 121.18.238.0/24 -j DROP
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 221.194.47.0/24 -j DROP
If you don't have business with them just block all incoming connection from them:
# iptables -A INPUT -s 119.249.54.0/24 -j DROP
# iptables -A INPUT -s 121.18.238.0/24 -j DROP
# iptables -A INPUT s 221.194.47.0/24 -j DROP
If you install ipset follow this to setup ipset, and download ipset to block ssh black list from here

My Notes