察看系统日志发现大量 sshd信息

Question

察看系统日志发现大量如下信息，不知道如何应对。
Mar 14 08:47:59 tuhigh sshd(pam_unix)[9974]: check pass; user unknown
Mar 14 08:47:59 tuhigh sshd(pam_unix)[9974]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:06 tuhigh sshd(pam_unix)[9976]: check pass; user unknown
Mar 14 08:48:06 tuhigh sshd(pam_unix)[9976]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:12 tuhigh sshd(pam_unix)[9978]: check pass; user unknown
Mar 14 08:48:12 tuhigh sshd(pam_unix)[9978]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:17 tuhigh sshd(pam_unix)[9980]: check pass; user unknown
Mar 14 08:48:17 tuhigh sshd(pam_unix)[9980]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:21 tuhigh sshd(pam_unix)[9982]: check pass; user unknown
Mar 14 08:48:21 tuhigh sshd(pam_unix)[9982]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:26 tuhigh sshd(pam_unix)[9984]: check pass; user unknown
Mar 14 08:48:26 tuhigh sshd(pam_unix)[9984]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:30 tuhigh sshd(pam_unix)[9986]: check pass; user unknown
Mar 14 08:48:30 tuhigh sshd(pam_unix)[9986]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:34 tuhigh sshd(pam_unix)[9988]: check pass; user unknown
Mar 14 08:48:34 tuhigh sshd(pam_unix)[9988]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:39 tuhigh sshd(pam_unix)[9990]: check pass; user unknown
Mar 14 08:48:39 tuhigh sshd(pam_unix)[9990]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:43 tuhigh sshd(pam_unix)[9992]: check pass; user unknown
Mar 14 08:48:43 tuhigh sshd(pam_unix)[9992]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:48 tuhigh sshd(pam_unix)[9994]: check pass; user unknown
Mar 14 08:48:48 tuhigh sshd(pam_unix)[9994]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:48:58 tuhigh sshd(pam_unix)[9996]: check pass; user unknown
Mar 14 08:48:58 tuhigh sshd(pam_unix)[9996]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.126.176.244
Mar 14 08:49:08 tuhigh sshd(pam_unix)[10000]: check pass; user unknown
Mar

Answer 1

看来有人在尝试用工具在对你进行扫描！并尝试以暴力破解的方式猜密码。

Answer 2

基本上每天都会发现这些东西，有时会持续很多个小时。这种威胁也不会太大吧 ！

Answer 3

只要你的密码复杂度够，有防火墙并做访问限制，一般没有太大问题。

Answer 4

我的解决方法是写个脚本，找出这个IP，只要这个IP超过10次失败，就把这个IP加入iptables drop了。
用了这个脚本后，log 少了很多。
这样的脚本，论坛上就有好几个可以参考的了。

Answer 5

http://www.bornin76.cn/?p=31