오늘 나는 에 대한 매우 많은 수의 로그를 발견했으며 ssh누군가가 내 Linux 서버에 액세스하려고 시도하고 있다고 가정할 수 있습니다.
로그는 다음과 같습니다.
-- Logs begin at Wed 2023-08-02 08:59:10 EEST, end at Wed 2024-01-24 08:57:36 EET. --
ian 24 08:53:49 Linux-Server sshd[372712]: Invalid user mireielle from 201.184.50.251 port 59440
ian 24 08:53:49 Linux-Server sshd[372712]: pam_unix(sshd:auth): check pass; user unknown
ian 24 08:53:49 Linux-Server sshd[372712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.184.50.251
ian 24 08:53:51 Linux-Server sshd[372712]: Failed password for invalid user mireielle from 201.184.50.251 port 59440 ssh2
ian 24 08:53:51 Linux-Server sshd[372712]: Received disconnect from 201.184.50.251 port 59440:11: Bye Bye [preauth]
ian 24 08:53:51 Linux-Server sshd[372712]: Disconnected from invalid user mireielle 201.184.50.251 port 59440 [preauth]
ian 24 08:54:08 Linux-Server sshd[372726]: User root from 218.92.0.29 not allowed because not listed in AllowUsers
ian 24 08:54:09 Linux-Server sshd[372726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.29 user=root
ian 24 08:54:11 Linux-Server sshd[372726]: Failed password for invalid user root from 218.92.0.29 port 41135 ssh2
ian 24 08:54:14 Linux-Server sshd[372726]: Failed password for invalid user root from 218.92.0.29 port 41135 ssh2
ian 24 08:54:14 Linux-Server sshd[372731]: Invalid user hawkos from 118.163.63.23 port 33902
ian 24 08:54:14 Linux-Server sshd[372731]: pam_unix(sshd:auth): check pass; user unknown
ian 24 08:54:14 Linux-Server sshd[372731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.63.23
ian 24 08:54:16 Linux-Server sshd[372731]: Failed password for invalid user hawkos from 118.163.63.23 port 33902 ssh2
ian 24 08:54:16 Linux-Server sshd[372731]: Received disconnect from 118.163.63.23 port 33902:11: Bye Bye [preauth]
ian 24 08:54:16 Linux-Server sshd[372731]: Disconnected from invalid user hawkos 118.163.63.23 port 33902 [preauth]
ian 24 08:54:18 Linux-Server sshd[372726]: Failed password for invalid user root from 218.92.0.29 port 41135 ssh2
ian 24 08:54:20 Linux-Server sshd[372726]: Received disconnect from 218.92.0.29 port 41135:11: [preauth]
ian 24 08:54:20 Linux-Server sshd[372726]: Disconnected from invalid user root 218.92.0.29 port 41135 [preauth]
ian 24 08:54:20 Linux-Server sshd[372726]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.29 user=root
ian 24 08:54:50 Linux-Server sshd[372743]: User root from 218.92.0.29 not allowed because not listed in AllowUsers
ian 24 08:54:50 Linux-Server sshd[372743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.29 user=root
ian 24 08:54:52 Linux-Server sshd[372743]: Failed password for invalid user root from 218.92.0.29 port 23264 ssh2
ian 24 08:54:54 Linux-Server sshd[372743]: Failed password for invalid user root from 218.92.0.29 port 23264 ssh2
ian 24 08:54:55 Linux-Server sshd[372745]: Invalid user skaret from 201.184.50.251 port 51582
ian 24 08:54:55 Linux-Server sshd[372745]: pam_unix(sshd:auth): check pass; user unknown
ian 24 08:54:55 Linux-Server sshd[372745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.184.50.251
ian 24 08:54:57 Linux-Server sshd[372743]: Failed password for invalid user root from 218.92.0.29 port 23264 ssh2
ian 24 08:54:57 Linux-Server sshd[372745]: Failed password for invalid user skaret from 201.184.50.251 port 51582 ssh2
ian 24 08:54:59 Linux-Server sshd[372743]: Received disconnect from 218.92.0.29 port 23264:11: [preauth]
ian 24 08:54:59 Linux-Server sshd[372743]: Disconnected from invalid user root 218.92.0.29 port 23264 [preauth]
ian 24 08:54:59 Linux-Server sshd[372743]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.29 user=root
ian 24 08:54:59 Linux-Server sshd[372745]: Received disconnect from 201.184.50.251 port 51582:11: Bye Bye [preauth]
ian 24 08:54:59 Linux-Server sshd[372745]: Disconnected from invalid user skaret 201.184.50.251 port 51582 [preauth]
ian 24 08:55:13 Linux-Server sshd[372748]: User root from 180.101.88.221 not allowed because not listed in AllowUsers
ian 24 08:55:13 Linux-Server sshd[372748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.101.88.221 user=root
ian 24 08:55:15 Linux-Server sshd[372748]: Failed password for invalid user root from 180.101.88.221 port 62046 ssh2
ian 24 08:55:18 Linux-Server sshd[372748]: Failed password for invalid user root from 180.101.88.221 port 62046 ssh2
ian 24 08:55:21 Linux-Server sshd[372748]: Failed password for invalid user root from 180.101.88.221 port 62046 ssh2
ian 24 08:55:23 Linux-Server sshd[372748]: Received disconnect from 180.101.88.221 port 62046:11: [preauth]
ian 24 08:55:23 Linux-Server sshd[372748]: Disconnected from invalid user root 180.101.88.221 port 62046 [preauth]
ian 24 08:55:23 Linux-Server sshd[372748]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.101.88.221 user=root
ian 24 08:56:04 Linux-Server sshd[372762]: Invalid user ubuntu from 201.184.50.251 port 43720
ian 24 08:56:04 Linux-Server sshd[372762]: pam_unix(sshd:auth): check pass; user unknown
ian 24 08:56:04 Linux-Server sshd[372762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.184.50.251
ian 24 08:56:06 Linux-Server sshd[372762]: Failed password for invalid user ubuntu from 201.184.50.251 port 43720 ssh2
ian 24 08:56:08 Linux-Server sshd[372762]: Received disconnect from 201.184.50.251 port 43720:11: Bye Bye [preauth]
ian 24 08:56:08 Linux-Server sshd[372762]: Disconnected from invalid user ubuntu 201.184.50.251 port 43720 [preauth]
ian 24 08:56:48 Linux-Server sshd[372771]: Invalid user alberik from 118.163.63.23 port 38078
ian 24 08:56:48 Linux-Server sshd[372771]: pam_unix(sshd:auth): check pass; user unknown
ian 24 08:56:48 Linux-Server sshd[372771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.63.23
ian 24 08:56:50 Linux-Server sshd[372771]: Failed password for invalid user alberik from 118.163.63.23 port 38078 ssh2
ian 24 08:56:51 Linux-Server sshd[372771]: Received disconnect from 118.163.63.23 port 38078:11: Bye Bye [preauth]
지난 5분간의 로그입니다.
나는 그것들을 처음부터 다시 추적했습니다 Octomber 23, 00:00:42 AM. 그리고 정말 수상한 것 같아요.
제가 걱정할 게 있나요? 5명의 허용된 SSH 사용자가 있는데 그 중 2명은 SSH 감옥에 포함되어 있으며 다음 폴더에만 액세스할 수 있습니다.
bin dev etc lib lib64 proc run sbin share sys tmp usr
공유는 특정 사용자가 특정 폴더에 액세스할 수 있도록 하는 중간 디렉터리일 뿐입니다.
그럼 나 해킹당하는 걸까? 이것은 잠재적인 DDoS 공격입니까? 어떡해?
어떤 조언이라도 감사하겠습니다!
답변1
인터넷에 서비스를 열면 일부 봇넷이 해당 서비스를 찾아 보안 허점을 찾기 시작할 때까지 시간이 오래 걸리지 않을 것입니다.
- 서버를 최신 상태로 유지하세요
- 알려진 사용자 이름으로 로그인 비활성화(
root) - 비밀번호 로그인 비활성화, 공개 키 인증만 사용
- 가능하다면 방화벽을 통해 서비스에 대한 액세스를 특정 IP 주소 또는 서브넷으로 제한하십시오.
- 서버를 조사하기 어렵게 만들기 위해 Fail2ban을 설정하십시오.