我最近做了很多关于如何设置 FTP 服务器（VSFTPD 3.0.5）并保护它的研究，以至于我觉得相当舒服地从我的衣柜中运行它并将其从我的家庭网络暴露到互联网上与选定的少数人分享。
我已经让服务器运行并暴露在互联网上大约 36 个小时了（眼睛密切关注连接日志），并且我已经注意到至少有两个不同的场合我可以看到似乎是少数的内容未知的 IP尝试（从我所知的所有迹象来看均未成功）登录，或者只是用垃圾模糊 FTP 登录提示，希望以某种方式破坏它？我真的无法理解他们在这里所做的事情，如果事实上这是一个糟糕的演员。这是服务器日志的示例：
Sat Jan 6 15:27:02 2024 [pid 1553282] CONNECT: Client "199.45.154.16"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "220 Take a file, leave a file."
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16", "????????????!??#?_??NV????ZBV??M??R???E??MU l?"??w??s??]#????Y??w??""
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16", "G??XP??????3?G???????9?K???????E?????????????#?????+?"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16", "?$?????,?R?S???????????????'?/???(?0?`?A?V?W?????????????"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16", "?/?<???????5?=???????A?????????????????????????<MY_HOME_IP>???????????????"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP command: Client "199.45.154.16", "?"
Sat Jan 6 15:27:02 2024 [pid 1553282] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:03 2024 [pid 1553286] CONNECT: Client "199.45.154.16"
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP response: Client "199.45.154.16", "220 Take a file, leave a file."
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP command: Client "199.45.154.16", "??????????????F?Z?0????YE???L[7I?IQ?]Q????] ?A?3????!"1?h#u??u?K?m????xU?G?????????????????A???????=?5???????<?/?"
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP command: Client "199.45.154.16", "?????????????W?V?A?`?0?(???/?'???????????????S?R?,?????$?"
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP command: Client "199.45.154.16", "?+?????#?????????????E???????K?9???????G?3???????????????<MY_HOME_IP>???????????????"
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP command: Client "199.45.154.16", "?"
Sat Jan 6 15:27:03 2024 [pid 1553286] FTP response: Client "199.45.154.16", "530 Please login with USER and PASS."
anonymous他们只是继续做这样的事情，或者尝试以我已禁用的身份登录。我注意到这些时间戳非常接近，我确信这必须是某种自动化/脚本。AI 建议可以对“命令”进行加密或以某种方式进行混淆，但我认为不会，因为如果我登录并发送合法命令，VSFTPD 会以纯文本形式清楚地记录它们。
我在想有人正在探测旧版本服务器中的漏洞？我读到 VSFTPD 2.3.4 存在一个大问题，所以也许这就是漏洞利用的方式？
我很惊讶在我的 IP 上运行的这台服务器被发现的速度如此之快，并试图确认发生了什么，以及我是否可以采取主动措施来保证它的安全（除了使服务器脱机）。VSFTPD 目前并未被源 IP 锁定，尽管我现在正在考虑这一点。我还读到一些关于人们fail2ban在他们的 FTP 服务器上使用的内容？我从未使用过它，但如果这有帮助，我很感兴趣。