主页 / server / 问题 / 560272
Accepted
DD.
Asked: 2013-12-10 21:44:55 +0800 CST

Amazon Linux Breakin Attempt [重复]

  • 772

我正在查看 /var/log/secure 并注意到以下内容：

Dec  9 06:03:20 ip-10-58-218-177 sshd[3794]: Did not receive identification string from 177.99.169.130
Dec  9 06:46:12 ip-10-58-218-177 sshd[3897]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:12 ip-10-58-218-177 sshd[3897]: Invalid user admin from 177.99.169.130
Dec  9 06:46:12 ip-10-58-218-177 sshd[3897]: input_userauth_request: invalid user admin [preauth]
Dec  9 06:46:13 ip-10-58-218-177 sshd[3897]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:14 ip-10-58-218-177 sshd[3899]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:15 ip-10-58-218-177 sshd[3899]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:16 ip-10-58-218-177 sshd[3901]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:16 ip-10-58-218-177 sshd[3901]: Invalid user user from 177.99.169.130
Dec  9 06:46:16 ip-10-58-218-177 sshd[3901]: input_userauth_request: invalid user user [preauth]
Dec  9 06:46:17 ip-10-58-218-177 sshd[3901]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:19 ip-10-58-218-177 sshd[3903]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:19 ip-10-58-218-177 sshd[3903]: Invalid user guest from 177.99.169.130
Dec  9 06:46:19 ip-10-58-218-177 sshd[3903]: input_userauth_request: invalid user guest [preauth]
Dec  9 06:46:19 ip-10-58-218-177 sshd[3903]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:21 ip-10-58-218-177 sshd[3905]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:21 ip-10-58-218-177 sshd[3905]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:23 ip-10-58-218-177 sshd[3907]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:23 ip-10-58-218-177 sshd[3907]: Invalid user xbian from 177.99.169.130
Dec  9 06:46:23 ip-10-58-218-177 sshd[3907]: input_userauth_request: invalid user xbian [preauth]
Dec  9 06:46:23 ip-10-58-218-177 sshd[3907]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]
Dec  9 06:46:25 ip-10-58-218-177 sshd[3909]: reverse mapping checking getaddrinfo for grupoazul130.static.host.gvt.net.br [177.99.169.130] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  9 06:46:25 ip-10-58-218-177 sshd[3909]: Invalid user D-Link from 177.99.169.130
Dec  9 06:46:25 ip-10-58-218-177 sshd[3909]: input_userauth_request: invalid user D-Link [preauth]
Dec  9 06:46:25 ip-10-58-218-177 sshd[3909]: Received disconnect from 177.99.169.130: 11: Bye Bye [preauth]

这是什么意思，我应该担心吗？

linux

1 个回答

  1. Best Answer

    那就是通常的随机扫描试图找到默认的用户名和密码。通常这不是问题，但如果您担心，fail2ban，正确配置应该可以摆脱蛮力尝试。默认的 ssh 规则应该足够好。

    • 3

相关问题