<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">100% normal. Pick a strong pw or an SSH key and you are fine. <br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 6. Nov 2019, at 19:44, David Strappazon <<a href="mailto:david.strappazon@protonmail.com" class="">david.strappazon@protonmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hello everyone,<br class=""></div><div class=""><br class=""></div><div class="">i'm running a bridge on a raspberry Pi 3B+ on Kali Linux.<br class=""><br class="">Everything looks fine but after checking the logs i noticed that the service rebooted by itself in the middle on the night:</div><div class=""><br class=""></div><div class="">Nov 06 03:51:09.000 [notice] Interrupt: we have stopped accepting new connections, and will shut down in 30 seconds. Interrupt again to exit now.<br class=""></div><div class="">Nov 06 03:51:10.000 [notice] Delaying directory fetches: We are hibernating or shutting down.<br class=""></div><div class="">Nov 06 03:51:39.000 [notice] Clean shutdown finished. Exiting.<br class=""></div><div class="">etc...<br class=""><br class="">Then after that, it works again (will check tonight /tomorrow if it reboots again).<br class=""><br class="">I'm trying to find why it is rebooting but without success. I checked all logs possible and also notice this in journalctl -xe:</div><div class=""><br class=""></div><div class="">nov. 06 19:37:58 kali-pi sshd[15920]: Failed password for root from XXXXX port 37494 ssh2<br class=""></div><div class="">nov. 06 19:38:03 kali-pi sshd[15920]: Failed password for root from XXXX port 37494 ssh2<br class=""></div><div class="">nov. 06 19:38:08 kali-pi sshd[15920]: Failed password for root from XXXXX port 37494 ssh2<br class=""></div><div class="">nov. 06 19:38:13 kali-pi sshd[15920]: Failed password for root from XXXXX port 37494 ssh2<br class=""></div><div class="">nov. 06 19:38:18 kali-pi sshd[15920]: Failed password for root from XXXXX port 37494 ssh2<br class=""></div><div class="">nov. 06 19:38:18 kali-pi sshd[15920]: error: maximum authentication attempts exceeded for root from 21><br class=""></div><div class="">nov. 06 19:38:18 kali-pi sshd[15920]: Disconnecting authenticating user root 2XXXX port 37494: ><br class=""></div><div class="">nov. 06 19:38:18 kali-pi sshd[15920]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ss><br class=""></div><div class="">nov. 06 19:38:18 kali-pi sshd[15920]: PAM service(sshd) ignoring max retries; 6 > 3<br class=""></div><div class="">nov. 06 19:38:21 kali-pi sshd[15950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid><br class=""></div><div class="">nov. 06 19:38:22 kali-pi sshd[15953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid><br class=""></div><div class="">nov. 06 19:38:23 kali-pi sshd[15950]: Failed password for root from XXXX port 64786 ssh2<br class=""></div><div class="">nov. 06 19:38:23 kali-pi sshd[15953]: Failed password for root from XXXXX port 6739 ssh2<br class=""></div><div class=""><br class=""></div><div class="">There's two different IP that i don't know. A whois says it's a Chinese provider...<br class=""></div><div class=""><br class=""></div><div class="">Should i consider that someone is trying to break into my home network?<br class=""><br class=""></div><div class=""><br class=""></div><div class="protonmail_signature_block"><div class="protonmail_signature_block-user protonmail_signature_block-empty"><br class=""></div><div class="protonmail_signature_block-proton">Sent with <a href="https://protonmail.com/" target="_blank" class="">ProtonMail</a> Secure Email.<br class=""></div></div><div class=""><br class=""></div>_______________________________________________<br class="">tor-relays mailing list<br class=""><a href="mailto:tor-relays@lists.torproject.org" class="">tor-relays@lists.torproject.org</a><br class="">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br class=""></div></blockquote></div><br class=""></body></html>