NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Why is my Netgear router trying to hack my NAS?
I had this happen with another Netgear router and returned it and got another, but same thing. The router is constantly trying to log into my Synology NAS using usernames like "user" and "admin". I...
The usernames it is using to try and get into my NAS with are ones like "vagrant", "root", "mysql", and "andy" (for some weird reason...). The online chat person says it is my NAS blocking the router, which it should, and that I should unblock all those usernames so the router can use them. And then they disconnected the chat.
"The IP address [192.168.1.1] experienced 10 failed attempts when attempting to log in to SSH running on Synology418play within 5 minutes and was blocked..."The usernames it is using to try and get into my NAS with are ones like "vagrant", "root", "mysql", and "andy"
What model router are you using, and what firmware is it running?
Are you seeing any attempts to log into other devices on your network?
Is Armor enabled on the router?
Nighthawk Tri-Band WiFi 7 model RS280S. Firmware: 1.0.5.22. I have SSH disabled on most of my other devices except a couple game servers and I see the same attempts on those. Everything is defaults and it looks like Armor was enabled when I set up the router.
I have SSH disabled on most of my other devices except a couple game servers and I see the same attempts on those.
The first step in establishing an SSH (or SCP) session would be opening up a TCP connection. Which can't - unless some kind of SSH service listener is enabled on your NAS, waiting for a connection, including the possible vulnerability checking.
Test with something like this to check if there is some listener on port 22 active on your NAS:
netstat -an | grep 22unless some kind of SSH service listener is enabled on your NAS, waiting for a connection,
pkellum: Synology NAS do have intrusion detection, and I think it is being triggered by Armor's device scan. See this post (from 2022):
So begin by disabling Armor, and see if the problem stops.
schumaku: Note per this post, the intrusion detection on the Synology is enabled even if ssh is not enabled.
