< OS 有关 > 阿里云 几个小时前 使用密钥替换 SSH 密码认证后, 发现主机正在被“攻击” 分析与应对

信息来源:

文件:/var/log/auth.log

因为在 sshd_config 配置文件中,已经定义 LogLevel INFO 

部分内容:

2025-01-27T18:18:55.682727+08:00 jpn sshd[15891]: Received disconnect from 45.194.37.171 port 58954:11: Bye Bye [preauth]
2025-01-27T18:18:55.682852+08:00 jpn sshd[15891]: Disconnected from invalid user es 45.194.37.171 port 58954 [preauth]
2025-01-27T18:19:30.861201+08:00 jpn sshd[15894]: Accepted publickey for root from **** port 37287 ssh2: ED25519 SHA256:jpUCXR/o4OM5+8TNsIYfpJyZWHLLxghIOe36RMVEx+0
2025-01-27T18:19:30.863454+08:00 jpn sshd[15894]: pam_unix(sshd:session): session opened for user root(uid=0) by root(uid=0)
2025-01-27T18:19:30.894649+08:00 jpn systemd-logind[834]: New session 68 of user root.
2025-01-27T18:19:30.936765+08:00 jpn (systemd): pam_unix(systemd-user:session): session opened for user root(uid=0) by root(uid=0)
2025-01-27T18:19:40.757504+08:00 jpn sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/visudo
2025-01-27T18:19:40.758049+08:00 jpn sudo: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)
2025-01-27T18:19:48.862708+08:00 jpn sshd[16046]: Connection closed by 2.57.122.32 port 45270
2025-01-27T18:19:49.986155+08:00 jpn sudo: pam_unix(sudo:session): session closed for user root
2025-01-27T18:19:52.902680+08:00 jpn sudo:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/visudo
2025-01-27T18:19:52.904224+08:00 jpn sudo: pam_unix(sudo:session): session opened for user root(uid=0) by root(uid=0)
2025-01-27T18:19:59.817863+08:00 jpn sshd[16051]: Invalid user es from 103.27.36.57 port 52330
2025-01-27T18:19:59.927275+08:00 jpn sshd[16051]: Received disconnect from 103.27.36.57 port 52330:11: Bye Bye [preauth]
2025-01-27T18:19:59.927353+08:00 jpn sshd[16051]: Disconnected from invalid user es 103.27.36.57 port 52330 [preauth]
2025-01-27T18:20:22.627449+08:00 jpn sshd[16055]: Received disconnect from 218.92.0.229 port 27794:11:  [preauth]
2025-01-27T18:20:22.627596+08:00 jpn sshd[16055]: Disconnected from 218.92.0.229 port 27794 [preauth]
2025-01-27T18:20:22.745077+08:00 jpn sshd[16057]: Invalid user sammy from 45.194.37.171 port 45126
2025-01-27T18:20:22.812352+08:00 jpn sshd[16057]: Received disconnect from 45.194.37.171 port 45126:11: Bye Bye [preauth]
2025-01-27T18:20:22.812444+08:00 jpn sshd[16057]: Disconnected from invalid user sammy 45.194.37.171 port 45126 [preauth]
2025-01-27T18:20:26.370459+08:00 jpn sshd[16059]: Invalid user test from 185.213.165.222 port 41514
2025-01-27T18:20:26.709218+08:00 jpn sshd[16059]: Received disconnect from 185.213.165.222 port 41514:11: Bye Bye [preauth]
2025-01-27T18:20:26.709308+08:00 jpn sshd[16059]: Disconnected from invalid user test 185.213.165.222 port 41514 [preauth]
2025-01-27T18:20:42.828438+08:00 jpn sudo: pam_unix(sudo:session): session closed for user root
2025-01-27T18:21:23.015774+08:00 jpn sshd[16098]: Invalid user ftpuser from 103.27.36.57 port 58928
2025-01-27T18:21:23.118253+08:00 jpn sshd[16098]: Received disconnect from 103.27.36.57 port 58928:11: Bye Bye [preauth]
2025-01-27T18:21:23.118331+08:00 jpn sshd[16098]: Disconnected from invalid user ftpuser 103.27.36.57 port 58928 [preauth]
2025-01-27T18:21:40.835987+08:00 jpn sshd[16101]: Invalid user dev from 185.213.165.222 port 39898
2025-01-27T18:21:41.196305+08:00 jpn sshd[16101]: Received disconnect from 185.213.165.222 port 39898:11: Bye Bye [preauth]
2025-01-27T18:21:41.196384+08:00 jpn sshd[16101]: Disconnected from invalid user dev 185.213.165.222 port 39898 [preauth]
2025-01-27T18:21:50.976607+08:00 jpn sshd[16103]: Invalid user alex from 45.194.37.171 port 33420
2025-01-27T18:21:51.038467+08:00 jpn sshd[16103]: Received disconnect from 45.194.37.171 port 33420:11: Bye Bye [preauth]
2025-01-27T18:21:51.038551+08:00 jpn sshd[16103]: Disconnected from invalid user alex 45.194.37.171 port 33420 [preauth]
2025-01-27T18:22:00.498436+08:00 jpn sshd[16105]: Received disconnect from 218.92.0.221 port 29964:11:  [preauth]
2025-01-27T18:22:00.498537+08:00 jpn sshd[16105]: Disconnected from 218.92.0.221 port 29964 [preauth]
2025-01-27T18:22:03.387463+08:00 jpn sshd[16107]: Received disconnect from 218.92.0.222 port 57854:11:  [preauth]
2025-01-27T18:22:03.387564+08:00 jpn sshd[16107]: Disconnected from 218.92.0.222 port 57854 [preauth]
2025-01-27T18:22:46.297244+08:00 jpn sshd[16109]: Invalid user sammy from 103.27.36.57 port 51744
2025-01-27T18:22:46.409949+08:00 jpn sshd[16109]: Received disconnect from 103.27.36.57 port 51744:11: Bye Bye [preauth]
2025-01-27T18:22:46.410041+08:00 jpn sshd[16109]: Disconnected from invalid user sammy 103.27.36.57 port 51744 [preauth]
2025-01-27T18:23:03.386976+08:00 jpn sshd[16111]: Invalid user server from 185.213.165.222 port 39412
2025-01-27T18:23:03.736443+08:00 jpn sshd[16111]: Received disconnect from 185.213.165.222 port 39412:11: Bye Bye [preauth]
2025-01-27T18:23:03.736530+08:00 jpn sshd[16111]: Disconnected from invalid user server 185.213.165.222 port 39412 [preauth]
2025-01-27T18:23:24.999251+08:00 jpn sshd[16116]: Invalid user user1 from 45.194.37.171 port 37228
2025-01-27T18:23:25.063685+08:00 jpn sshd[16116]: Received disconnect from 45.194.37.171 port 37228:11: Bye Bye [preauth]
2025-01-27T18:23:25.063778+08:00 jpn sshd[16116]: Disconnected from invalid user user1 45.194.37.171 port 37228 [preauth]
2025-01-27T18:24:04.966112+08:00 jpn sshd[16120]: Received disconnect from 103.27.36.57 port 57388:11: Bye Bye [preauth]
2025-01-27T18:24:04.966269+08:00 jpn sshd[16120]: Disconnected from authenticating user admin 103.27.36.57 port 57388 [preauth]
2025-01-27T18:24:15.054187+08:00 jpn sshd[16122]: Invalid user smart from 185.213.165.222 port 39408
2025-01-27T18:24:15.377906+08:00 jpn sshd[16122]: Received disconnect from 185.213.165.222 port 39408:11: Bye Bye [preauth]
2025-01-27T18:24:15.378009+08:00 jpn sshd[16122]: Disconnected from invalid user smart 185.213.165.222 port 39408 [preauth]
2025-01-27T18:25:01.028050+08:00 jpn CRON[16125]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
2025-01-27T18:25:01.030389+08:00 jpn CRON[16125]: pam_unix(cron:session): session closed for user root
2025-01-27T18:25:01.780947+08:00 jpn sshd[16128]: Invalid user smart from 45.194.37.171 port 54306
2025-01-27T18:25:01.841197+08:00 jpn sshd[16128]: Received disconnect from 45.194.37.171 port 54306:11: Bye Bye [preauth]
2025-01-27T18:25:01.841281+08:00 jpn sshd[16128]: Disconnected from invalid user smart 45.194.37.171 port 54306 [preauth]
2025-01-27T18:25:19.503142+08:00 jpn sshd[16130]: Invalid user test from 103.27.36.57 port 49936
2025-01-27T18:25:19.604616+08:00 jpn sshd[16130]: Received disconnect from 103.27.36.57 port 49936:11: Bye Bye [preauth]
2025-01-27T18:25:19.604710+08:00 jpn sshd[16130]: Disconnected from invalid user test 103.27.36.57 port 49936 [preauth]
2025-01-27T18:25:21.589372+08:00 jpn sshd[16132]: Invalid user steam from 185.213.165.222 port 58956
2025-01-27T18:25:21.937081+08:00 jpn sshd[16132]: Received disconnect from 185.213.165.222 port 58956:11: Bye Bye [preauth]
2025-01-27T18:25:21.937164+08:00 jpn sshd[16132]: Disconnected from invalid user steam 185.213.165.222 port 58956 [preauth]
2025-01-27T18:26:27.432529+08:00 jpn sshd[16136]: Invalid user deploy from 185.213.165.222 port 43124
2025-01-27T18:26:27.766964+08:00 jpn sshd[16136]: Received disconnect from 185.213.165.222 port 43124:11: Bye Bye [preauth]
2025-01-27T18:26:27.767062+08:00 jpn sshd[16136]: Disconnected from invalid user deploy 185.213.165.222 port 43124 [preauth]
2025-01-27T18:26:36.494292+08:00 jpn sshd[16138]: Invalid user dev from 103.27.36.57 port 50164
2025-01-27T18:26:36.595899+08:00 jpn sshd[16138]: Received disconnect from 103.27.36.57 port 50164:11: Bye Bye [preauth]
2025-01-27T18:26:36.596008+08:00 jpn sshd[16138]: Disconnected from invalid user dev 103.27.36.57 port 50164 [preauth]
2025-01-27T18:26:37.148520+08:00 jpn sshd[16141]: Received disconnect from 45.194.37.171 port 43148:11: Bye Bye [preauth]
2025-01-27T18:26:37.148638+08:00 jpn sshd[16141]: Disconnected from authenticating user admin 45.194.37.171 port 43148 [preauth]
2025-01-27T18:27:19.961834+08:00 jpn sshd[16144]: Invalid user udatabase from 139.19.117.130 port 34824
2025-01-27T18:27:19.962218+08:00 jpn sshd[16144]: userauth_pubkey: signature algorithm ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]
2025-01-27T18:27:28.842456+08:00 jpn sshd[16144]: Connection closed by invalid user udatabase 139.19.117.130 port 34824 [preauth]
2025-01-27T18:27:35.048858+08:00 jpn sshd[16146]: Invalid user user from 185.213.165.222 port 35672
2025-01-27T18:27:35.388298+08:00 jpn sshd[16146]: Received disconnect from 185.213.165.222 port 35672:11: Bye Bye [preauth]
2025-01-27T18:27:35.388373+08:00 jpn sshd[16146]: Disconnected from invalid user user 185.213.165.222 port 35672 [preauth]
2025-01-27T18:27:52.749556+08:00 jpn sshd[16148]: Invalid user debian from 103.27.36.57 port 33168
2025-01-27T18:27:52.856125+08:00 jpn sshd[16148]: Received disconnect from 103.27.36.57 port 33168:11: Bye Bye [preauth]
2025-01-27T18:27:52.856215+08:00 jpn sshd[16148]: Disconnected from invalid user debian 103.27.36.57 port 33168 [preauth]
2025-01-27T18:27:58.680968+08:00 jpn sshd[16150]: Invalid user sammy from 190.181.4.12 port 53132
2025-01-27T18:27:58.945670+08:00 jpn sshd[16150]: Received disconnect from 190.181.4.12 port 53132:11: Bye Bye [preauth]
2025-01-27T18:27:58.945810+08:00 jpn sshd[16150]: Disconnected from invalid user sammy 190.181.4.12 port 53132 [preauth]
2025-01-27T18:28:17.065155+08:00 jpn sshd[16152]: Invalid user deploy from 45.194.37.171 port 36046
2025-01-27T18:28:17.129274+08:00 jpn sshd[16152]: Received disconnect from 45.194.37.171 port 36046:11: Bye Bye [preauth]
2025-01-27T18:28:17.129355+08:00 jpn sshd[16152]: Disconnected from invalid user deploy 45.194.37.171 port 36046 [preauth]
root@jpn:~# cat /var/log/auth.logcat /var/log/auth.log

分析日志:

密集的暴力破解尝试,主要来自以下IP:

185.213.165.222:尝试 test, dev, server, smart, steam, deploy, user 等用户名
45.194.37.171:尝试 sammy, alex, user1, smart, deploy 等用户名
103.27.36.57:尝试 es, ftpuser, sammy, dev, debian 等用户名
139.19.117.130:使用了失效的 ssh-rsa 算法尝试登录
190.181.4.12:尝试 sammy 用户名
203.23.199.89
85.208.253.163

IP 也分布在世界各地。

应对方案:

要么更改 端口,还有用 fail2ban 来封禁频繁失败的 IP。

这里记录用 fail2ban

1. 安装 fail2ban

apt update
apt install fail2ban -y

2. 阿里云的 apt 服务器连不上

3. 更新 /etc/apt/sources.list

root@jpn:~# cat /etc/apt/sources.list
deb http://jp.archive.ubuntu.com/ubuntu/ noble main restricted universe multiverse
deb http://jp.archive.ubuntu.com/ubuntu/ noble-updates main restricted universe multiverse
deb http://jp.archive.ubuntu.com/ubuntu/ noble-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu/ noble-security main restricted universe multiverse

4. 继续安装 fail2ban

sudo apt update && sudo apt upgrade -y
apt install fail2ban -y

5. 创建配置文件

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

6. 编辑配置文件 /etc/fail2ban/jail.local

原内容:

我改后的内容:

策略:5分钟内失败3次就封1小时

7. 设置开机自启、启动服务

systemctl enable fail2ban
systemctl start fail2ban

如果配置有修改,重启服务

systemctl restart fail2ban

8. 如何 检查状态和查看封禁列表

1) 查看服务状态

2) 查看 sshd 的详细状态 封禁列表

3)检查配置命令
fail2ban-client get sshd bantime
fail2ban-client get sshd findtime
fail2ban-client get sshd maxretry

结束语:

这两晚在看阿里云的性能宕机问题,从删除阿里云服务, 使用密钥验证时增加ssh输出, 突然发现日志中有重试登录 IP。 现在安装 f2b来解决。

20年前的知识,还在能用上

这么会儿功夫,关了 8只

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.rhkb.cn/news/10881.html

如若内容造成侵权/违法违规/事实不符,请联系长河编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

[创业之路-270]:《向流程设计要效率》-2-企业流程架构模式 POS架构(规划、业务运营、支撑)、OES架构(业务运营、使能、支撑)

目录 一、POS架构 二、OES架构 三、POS架构与OES架构的差异 四、各自的典型示例 POS架构典型示例 OES架构典型示例 示例分析 五、各自的典型企业 POS架构典型企业 OES架构典型企业 分析 六、各自典型的流程 POS架构的典型流程 OES架构的典型流程 企业流程架构模式…

【贪心算法篇】:“贪心”之旅--算法练习题中的智慧与策略(一)

✨感谢您阅读本篇文章,文章内容是个人学习笔记的整理,如果哪里有误的话还请您指正噢✨ ✨ 个人主页:余辉zmh–CSDN博客 ✨ 文章所属专栏:贪心算法篇–CSDN博客 文章目录 一.贪心算法1.什么是贪心算法2.贪心算法的特点 二.例题1.柠…

Python 梯度下降法(二):RMSProp Optimize

文章目录 Python 梯度下降法(二):RMSProp Optimize一、数学原理1.1 介绍1.2 公式 二、代码实现2.1 函数代码2.2 总代码 三、代码优化3.1 存在问题3.2 收敛判断3.3 函数代码3.4 总代码 四、优缺点4.1 优点4.2 缺点 五、相关链接 Python 梯度下…

【2025年更新】1000个大数据/人工智能毕设选题推荐

文章目录 前言大数据/人工智能毕设选题:后记 前言 正值毕业季我看到很多同学都在为自己的毕业设计发愁 Maynor在网上搜集了1000个大数据的毕设选题,希望对大家有帮助~ 适合大数据毕业设计的项目,完全可以作为本科生当前较新的毕…

three.js+WebGL踩坑经验合集(6.2):负缩放,负定矩阵和行列式的关系(3D版本)

本篇将紧接上篇的2D版本对3D版的负缩放矩阵进行解读。 (6.1):负缩放,负定矩阵和行列式的关系(2D版本) 既然three.js对3D版的负缩放也使用行列式进行判断,那么,2D版的结论用到3D上其实是没毛病的,THREE.Li…

反向代理模块jmh

1 概念 1.1 反向代理概念 反向代理是指以代理服务器来接收客户端的请求,然后将请求转发给内部网络上的服务器,将从服务器上得到的结果返回给客户端,此时代理服务器对外表现为一个反向代理服务器。 对于客户端来说,反向代理就相当…

软件工程经济学-日常作业+大作业

目录 一、作业1 作业内容 解答 二、作业2 作业内容 解答 三、作业3 作业内容 解答 四、大作业 作业内容 解答 1.建立层次结构模型 (1)目标层 (2)准则层 (3)方案层 2.构造判断矩阵 (1)准则层判断矩阵 (2)方案层判断矩阵 3.层次单排序及其一致性检验 代码 …

【回溯】目标和 字母大小全排列

文章目录 494. 目标和解题思路:回溯784. 字母大小写全排列解题思路:回溯 494. 目标和 494. 目标和 给你一个非负整数数组 nums 和一个整数 target 。 向数组中的每个整数前添加 或 - ,然后串联起所有整数,可以构造一个 表达式…

告别复杂,拥抱简洁:用plusDays(7)代替plus(7, ChronoUnit.DAYS)

前言 你知道吗?有时候代码里的一些小细节看起来很简单,却可能成为你调试时的大麻烦。在 Java 中,我们用 LocalDateTime 进行日期和时间的操作时,发现一个小小的替代方法可以让代码更简洁,功能更强大。这不,今天我们就来探讨如何用 LocalDateTime.now().plusDays(7) 替代…

《苍穹外卖》项目学习记录-Day10订单状态定时处理

利用Cron表达式生成器生成Cron表达式 1.处理超时订单 查询订单表把超时的订单查询出来&#xff0c;也就是订单的状态为待付款&#xff0c;下单的时间已经超过了15分钟。 //select * from orders where status ? and order_time < (当前时间 - 15分钟) 遍历集合把数据库…

【深度分析】微软全球裁员计划不影响印度地区,将继续增加当地就业机会

当微软的裁员刀锋掠过全球办公室时&#xff0c;班加罗尔的键盘声却愈发密集——这场资本迁徙背后&#xff0c;藏着数字殖民时代最锋利的生存法则。 表面是跨国公司的区域战略调整&#xff0c;实则是全球人才市场的地壳运动。微软一边在硅谷裁撤年薪20万美金的高级工程师&#x…

Linux中 端口被占用如何解决

lsof命令查找 查找被占用端口 lsof -i :端口号 #示例 lsof -i :8080 lsof -i :3306 netstat命令查找 查找被占用端口 netstat -tuln | grep 端口号 #示例 netstat -tuln | grep 3306 netstat -tuln | grep 6379 ss命令查找 查找被占用端口 ss -tunlp | grep 端口号 #示例…

qt-Quick3D笔记之官方例程Runtimeloader Example运行笔记

qt-Quick3D笔记之官方例程Runtimeloader Example运行笔记 文章目录 qt-Quick3D笔记之官方例程Runtimeloader Example运行笔记1.例程运行效果2.例程缩略图3.项目文件列表4.main.qml5.main.cpp6.CMakeLists.txt 1.例程运行效果 运行该项目需要自己准备一个模型文件 2.例程缩略图…

高性能消息队列Disruptor

定义一个事件模型 之后创建一个java类来使用这个数据模型。 /* <h1>事件模型工程类&#xff0c;用于生产事件消息</h1> */ no usages public class EventMessageFactory implements EventFactory<EventMessage> { Overridepublic EventMessage newInstance(…

Spring Boot项目如何使用MyBatis实现分页查询

写在前面&#xff1a;大家好&#xff01;我是晴空๓。如果博客中有不足或者的错误的地方欢迎在评论区或者私信我指正&#xff0c;感谢大家的不吝赐教。我的唯一博客更新地址是&#xff1a;https://ac-fun.blog.csdn.net/。非常感谢大家的支持。一起加油&#xff0c;冲鸭&#x…

【Numpy核心编程攻略:Python数据处理、分析详解与科学计算】1.27 线性代数王国:矩阵分解实战指南

1.27 线性代数王国&#xff1a;矩阵分解实战指南 #mermaid-svg-JWrp2JAP9qkdS2A7 {font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}#mermaid-svg-JWrp2JAP9qkdS2A7 .error-icon{fill:#552222;}#mermaid-svg-JWrp2JAP9qkdS2A7 .erro…

EasyExcel使用详解

文章目录 EasyExcel使用详解一、引言二、环境准备与基础配置1、添加依赖2、定义实体类 三、Excel 读取详解1、基础读取2、自定义监听器3、多 Sheet 处理 四、Excel 写入详解1、基础写入2、动态列与复杂表头3、样式与模板填充 五、总结 EasyExcel使用详解 一、引言 EasyExcel 是…

FIDL:Flutter与原生通讯的新姿势,不局限于基础数据类型

void initUser(User user); } 2、执行命令./gradlew assembleDebug&#xff0c;生成IUserServiceStub类和fidl.json文件 3、打开通道&#xff0c;向Flutter公开方法 FidlChannel.openChannel(getFlutterEngine().getDartExecutor(), new IUserServiceStub() { Override void…

DIFY源码解析

偶然发现Github上某位大佬开源的DIFY源码注释和解析&#xff0c;目前还处于陆续不断更新地更新过程中&#xff0c;为大佬的专业和开源贡献精神点赞。先收藏链接&#xff0c;后续慢慢学习。 相关链接如下&#xff1a; DIFY源码解析

87.(3)攻防世界 web simple_php

之前做过&#xff0c;回顾 12&#xff0c;攻防世界simple_php-CSDN博客 进入靶场 <?php // 显示当前 PHP 文件的源代码&#xff0c;方便调试或查看代码结构 // __FILE__ 是 PHP 的一个魔术常量&#xff0c;代表当前文件的完整路径和文件名 show_source(__FILE__);// 包含…