ssh 我的伺服器的無效嘗試，如何防止這種情況？

Question

我有一個帶有 ssh 金鑰對身份驗證的郵件伺服器。在日誌檔案中，我總是注意到此類登入嘗試。

     debug1: session_input_channel_req: session 0 req [email protected]
Jan 16 10:44:58 mail sshd[20519]: debug1: Forked child 18504.
Jan 16 10:44:58 mail sshd[18504]: debug1: Set /proc/self/oom_score_adj to 0
Jan 16 10:44:58 mail sshd[18504]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7
Jan 16 10:44:58 mail sshd[18504]: debug1: inetd sockets after dupping: 3, 3
Jan 16 10:44:58 mail sshd[18504]: Connection from 211.222.177.29 port 58735 on 192.168.88.10 port 22
Jan 16 10:45:01 mail CRON[18510]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 16 10:45:01 mail CRON[18510]: pam_unix(cron:session): session closed for user root
Jan 16 10:45:18 mail sshd[18504]: Did not receive identification string from 211.222.177.29

Answer 1

• 將預設 SSH 端口 22 變更為其他端口，此類嘗試將顯著減少。

• 安裝和配置fail2ban將監視此類嘗試並在防火牆中阻止後續嘗試。

• ~/.ssh/authorized_keys您也可以透過在公鑰前面新增「from」節來設定允許存取 SSH 服務的 IP 範圍，如下所示：
  from="1.2.3.0/24,44.55.66.77" ssh-rsa ...key content...