1

今天我注意到我的 /var/log/secure 文件越来越大。这很奇怪，当我检查尾巴时，我得到了这样的东西：

Sep  6 18:37:58 asdf sshd[17615]: Failed password for root from 200.85.122.11 port 36126 ssh2
Sep  6 18:37:58 asdf sshd[17616]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:00 asdf sshd[17618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:02 asdf sshd[17618]: Failed password for root from 200.85.122.11 port 36445 ssh2
Sep  6 18:38:02 asdf sshd[17619]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:04 asdf sshd[17623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:06 asdf sshd[17623]: Failed password for root from 200.85.122.11 port 36776 ssh2
Sep  6 18:38:06 asdf sshd[17624]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:08 asdf sshd[17626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:10 asdf sshd[17626]: Failed password for root from 200.85.122.11 port 37072 ssh2
Sep  6 18:38:11 asdf sshd[17627]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:13 asdf sshd[17689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

Sep  6 18:38:15 asdf sshd[17689]: Failed password for root from 200.85.122.11 port 37390 ssh2
Sep  6 18:38:15 asdf sshd[17690]: Received disconnect from 200.85.122.11: 11: Bye Bye
Sep  6 18:38:17 asdf sshd[17700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.122.11  user=root

这看起来好像有人试图找到我的服务器的密码。

如何在多次尝试登录失败后阻止 IP（例如，如果在过去一小时内 10 次尝试登录失败，但是现在我的 VPS 每分钟至少收到 100 个失败的登录请求）。实际上，密码对于暴力破解来说太长太复杂了，但我不确定这种暴力破解是否会导致服务器负载。

4

3 回答 3

1

您可以使用 iptables 设置速率限制。看看这个链接： http: //www.debian-administration.org/articles/187

于 2012-09-06T22:52:28.813 回答
1

看我的帖子。Fail2Ban 是我的解决方案。https://unix.stackexchange.com/questions/204383/fail2ban-is-not-blocking-ips-trying-to-access-my-server-via-ssh/204393#204393

正如有人指出的那样，我认为在 sshd_config 中有这个指令 PermitRootLogin no 是一个很好的做法，以防万一。

于 2015-05-26T23:51:54.780 回答
0

您可以使用DenyHosts：效果很好。

于 2012-09-06T23:22:35.143 回答