How many login attempts is normal per day?

[gro]

Hi,

Perhaps this varies from user to user, but since opening up my NAS (DS212j) to the Internet via no-ip.com I've been getting maybe 3 apparently random login attempts per day. Logs show that no-one has actually been able to login and I only know about these attempts because I have IP block turned on and it e-mails me as it blocks IPs (I have tightened it up a bit to ban IPs after three failed logins in 10 mins).

I just wondered if this is the kind of frequency others experience too. Presumably these are bots somehow crawling the net and finding my IP. The frequency is a bit unnerving but all seems to be secure anyway so I suppose it can just go on and I will turn off e-mail notification in a while.

[mike42dk]

Hi

I think it depends of what kind off services you have running, when I have my Telnet and SHH opened, then my IP ban's is rising to 5-10 login attempts a day, but when I only enable fewer services then i have 2-3 attempts a week.

I have set my IP ban to 3 attempts within 3 min.

[gro]

Right, I only have the Web login and file services available (I think!). SSH and Telnet, FTP etc are turned off.

Sounds like what I have been getting is about average then. I've turned off e-mail notification now. Quite impressed with this DDNS system by the way. I had not heard of it but it is a clever way to get around the dynamic IP issue, it works and is free!

[floateruk]

Hi all.

I'm really new to NAS's and only got my synology at the weekend. I've actually only opened up ftp for internet access as I don't need internet streaming, and I'm happy using ftp.

I have noticed a couple of attempts at logins though from an IP traced to columbia. No access given, but I've now enabled ip blocker.

Is it just a given that attempts will be made? Is there anything else I should be doing to protect the system?

thanks for the input anyways.

Matt

[Goner]

when I have my Telnet and SHH opened, then my IP ban's is rising to 5-10 login attempts a day,

Are you using the standard ports, like 22 for SSH ?? I got login attempts too when I used the default ports ... that's because they scan the known ports, like 21, 22, 80 etc

Just use something like 7022 for SSH and portforward 7022 to 22 on your DS ; I haven't seen a login attempts in weeks.

[mike42dk]

when I have my Telnet and SHH opened, then my IP ban's is rising to 5-10 login attempts a day,

Are you using the standard ports, like 22 for SSH ?? I got login attempts too when I used the default ports ... that's because they scan the known ports, like 21, 22, 80 etc

Just use something like 7022 for SSH and portforward 7022 to 22 on your DS ; I haven't seen a login attempts in weeks.

Yes I know, but I only use my SHH/TelNET when Synology needs access, or I am doing some playing around, I always disable the services after use.

But you have a strong point on how to make your DS more safe, when exposed towards the internet.

[Goner]

But you have a strong point on how to make your DS more safe, when exposed towards the internet.

It really works ; I did that for FTP, SSH, HTTP, WebDAV (just add 7000 to the known port or use an easy to remember number) and I haven't seen login attempts for ages. Before that, not a day went by without a blocked IP ...

[axj]

I have been used to 0-7 login attempts every day since Jan 12, 2010 giving 871 attempts!
The Jan 19, 2012 I bought a new DS-212+ and installed DSM 4-2198 both on my DS-509+ and on the new DS-212+ and since that there have been zero (0) attempts to the 509+ while the 212+ have registered 12 attempts spread over the days from Feb 12 to Mar 30 (i.e. one per 5 days).

I use SSH/PuTTY/MC on both DS's and have activated everything except download and modules related to Apple and also being able to use most modules/control from outside.

[Avenge]

I'm relieved to find this is an average thing for most of us Synology users. Because since I set up my DS410 to use the new "synology.me" DDNS I've had about 2 to 3 per day. I originally had my DS set to block ip's from 3 failed attempts within 10 minutes, and then to relase those ip's after 24 hours. But once I started receiving all the failed login attempts I changed it to 3 failed attempts within 12 hours with no release. I wasn't sure if it was just some D-
Bag trying to hack into my DS or what, so it's nice to know that this is something we all deal with, I'm not so worried or paranoid about it anymore. And the advice about changing ports to 70** is a great suggestion so I'll set that up here in the next few days. Thanks Guys!!!

Semper Fi,
Nate (Sgt, USMC Retired)

"War is an ugly thing, but not the ugliest of things. The decayed and degraded state of moral and patriotic feeling which thinks that nothing is worth war is much worse. The person who has nothing for which he is willing to fight, nothing which is more important than his own personal safety, is a miserable creature, and has no chance of being free unless made or kept so by the exertions of better men than himself."
- John Stuart Mill

[myCloud]

I prefer to forward high numbered ports to standard ports on the Synology and our Macs in the router. For example, I have a string of high numbered ports directed to port 22 on the DS and the Macs. YMMV.