这样的日志是不是被攻击了?

Question

Aug 7 17:12:36 localhost sshd[1054]: Did not receive identification string from 219.157.115.14.
Aug 7 17:12:37 localhost xinetd[741]: START: ftp pid=1058 from=219.157.115.14
Aug 7 17:12:37 localhost xinetd[741]: START: ftp pid=1059 from=219.157.115.14
Aug 7 14:36:44 localhost xinetd[732]: START: ftp pid=3874 from=219.157.115.14
Aug 7 14:36:44 localhost xinetd[732]: START: ftp pid=3875 from=219.157.115.14
Aug 7 14:36:47 localhost xinetd[732]: EXIT: ftp pid=3875 duration=3(sec)
Aug 7 14:36:54 localhost xinetd[732]: START: ftp pid=3883 from=219.157.115.14
Aug 7 14:36:57 localhost xinetd[732]: EXIT: ftp pid=3883 duration=3(sec)
Aug 7 14:36:57 localhost xinetd[732]: EXIT: ftp pid=3874 duration=13(sec)
Aug 7 14:36:58 localhost xinetd[732]: START: ftp pid=3887 from=219.157.115.14
Aug 7 14:37:01 localhost xinetd[732]: START: ftp pid=3889 from=219.157.115.14
Aug 7 14:37:06 localhost xinetd[732]: EXIT: ftp pid=3889 duration=5(sec)
Aug 7 14:37:07 localhost xinetd[732]: START: ftp pid=3892 from=219.157.115.14
Aug 7 14:37:07 localhost xinetd[732]: START: ftp pid=3894 from=219.157.115.14
Aug 7 14:37:14 localhost xinetd[732]: START: ftp pid=3896 from=219.157.115.14
Aug 7 14:37:14 localhost xinetd[732]: EXIT: ftp pid=3887 duration=16(sec)
Aug 7 14:37:15 localhost xinetd[732]: START: ftp pid=3897 from=219.157.115.14
Aug 7 14:37:25 localhost xinetd[732]: START: ftp pid=3898 from=219.157.115.14
Aug 7 14:37:26 localhost xinetd[732]: EXIT: ftp pid=3894 duration=19(sec)
Aug 7 14:37:26 localhost xinetd[732]: EXIT: ftp pid=3897 duration=11(sec)
Aug 7 14:37:27 localhost xinetd[732]: START: ftp pid=3899 from=219.157.115.14
Aug 7 14:37:31 localhost xinetd[732]: EXIT: ftp pid=3892 duration=24(sec)
Aug 7 14:37:31 localhost xinetd[732]: START: ftp pid=3901 from=219.157.115.14
Aug 7 14:37:32 localhost sshd[3902]: Did not receive identification string from 219.157.115.14.
Aug 7 14:37:33 localhost xinetd[732]: START: ftp pid=3903 from=219.157.115.14
Aug 7 14:37:36 localhost xinetd[732]: EXIT: ftp pid=3896 duration=22(sec)
Aug 7 14:37:37 localhost xinetd[732]: EXIT: ftp pid=3899 duration=10(sec)
Aug 7 14:37:39 localhost xinetd[732]: EXIT: ftp pid=3901 duration=8(sec)
Aug 7 14:37:40 localhost xinetd[732]: EXIT: ftp pid=3898 duration=15(sec)
Aug 7 14:37:41 localhost xinetd[732]: START: ftp pid=3907 from=219.157.115.14
Aug 7 14:37:45 localhost xinetd[732]: START: ftp pid=3908 from=219.157.115.14
Aug 7 14:37:46 localhost xinetd[732]: START: ftp pid=3909 from=219.157.115.14
Aug 7 14:37:46 localhost xinetd[732]: START: ftp pid=3910 from=219.157.115.14
Aug 7 14:37:46 localhost xinetd[732]: START: ftp pid=3911 from=219.157.115.14
Aug 7 14:37:48 localhost xinetd[732]: EXIT: ftp pid=3907 duration=7(sec)
Aug 7 14:37:50 localhost xinetd[732]: EXIT: ftp pid=3903 duration=17(sec)
Aug 7 14:37:52 localhost xinetd[732]: START: ftp pid=3912 from=219.157.115.14
Aug 7 14:37:53 localhost xinetd[732]: START: ftp pid=3913 from=219.157.115.14
Aug 7 14:37:53 localhost xinetd[732]: START: ftp pid=3914 from=219.157.115.14
Aug 7 14:37:54 localhost xinetd[732]: START: ftp pid=3915 from=219.157.115.14
Aug 7 14:37:55 localhost xinetd[732]: START: ftp pid=3916 from=219.157.115.14
Aug 7 14:37:55 localhost xinetd[732]: START: ftp pid=3917 from=219.157.115.14
Aug 7 14:38:02 localhost xinetd[732]: EXIT: ftp pid=3908 duration=17(sec)
Aug 7 14:38:04 localhost xinetd[732]: EXIT: ftp pid=3911 duration=18(sec)
Aug 7 14:38:07 localhost xinetd[732]: EXIT: ftp pid=3910 duration=21(sec)
Aug 7 14:38:09 localhost xinetd[732]: EXIT: ftp pid=3909 duration=23(sec)
Aug 7 14:38:09 localhost xinetd[732]: START: ftp pid=3918 from=219.157.115.14
Aug 7 14:38:10 localhost xinetd[732]: EXIT: ftp pid=3913 duration=17(sec)
Aug 7 14:38:10 localhost xinetd[732]: START: ftp pid=3919 from=219.157.115.14
Aug 7 14:38:11 localhost xinetd[732]: START: ftp pid=3920 from=219.157.115.14
Aug 7 14:38:11 localhost xinetd[732]: START: ftp pid=3921 from=219.157.115.14
Aug 7 14:38:13 localhost xinetd[732]: EXIT: ftp pid=3912 duration=21(sec)
Aug 7 14:38:13 localhost xinetd[732]: EXIT: ftp pid=3914 duration=20(sec)
Aug 7 14:38:14 localhost xinetd[732]: EXIT: ftp pid=3916 duration=19(sec)
Aug 7 14:38:16 localhost xinetd[732]: EXIT: ftp pid=3915 duration=22(sec)
Aug 7 14:38:16 localhost xinetd[732]: EXIT: ftp pid=3917 duration=21(sec)
Aug 7 14:38:16 localhost xinetd[732]: START: ftp pid=3922 from=219.157.115.14
Aug 7 14:38:20 localhost xinetd[732]: EXIT: ftp pid=3918 duration=11(sec)
Aug 7 14:38:21 localhost xinetd[732]: START: ftp pid=3923 from=219.157.115.14
Aug 7 14:38:22 localhost xinetd[732]: EXIT: ftp pid=3922 duration=6(sec)
Aug 7 14:38:24 localhost xinetd[732]: START: ftp pid=3924 from=219.157.115.14
Aug 7 14:38:26 localhost xinetd[732]: START: ftp pid=3925 from=219.157.115.14
Aug 7 14:38:27 localhost xinetd[732]: START: ftp pid=3926 from=219.157.115.14
Aug 7 14:38:28 localhost xinetd[732]: EXIT: ftp pid=3919 duration=18(sec)
Aug 7 14:38:28 localhost xinetd[732]: EXIT: ftp pid=3921 duration=17(sec)
Aug 7 14:38:30 localhost xinetd[732]: START: ftp pid=3927 from=219.157.115.14
Aug 7 14:38:30 localhost xinetd[732]: START: ftp pid=3928 from=219.157.115.14
Aug 7 14:38:35 localhost xinetd[732]: EXIT: ftp pid=3920 duration=24(sec)
Aug 7 14:38:35 localhost xinetd[732]: EXIT: ftp pid=3925 duration=9(sec)
Aug 7 14:38:36 localhost xinetd[732]: START: ftp pid=3929 from=219.157.115.14
Aug 7 14:38:36 localhost xinetd[732]: START: ftp pid=3930 from=219.157.115.14
Aug 7 14:38:38 localhost xinetd[732]: EXIT: ftp pid=3926 duration=11(sec)
Aug 7 14:38:38 localhost xinetd[732]: EXIT: ftp pid=3928 duration=8(sec)
Aug 7 14:38:38 localhost xinetd[732]: START: ftp pid=3931 from=219.157.115.14
Aug 7 14:38:39 localhost xinetd[732]: EXIT: ftp pid=3927 duration=9(sec)
Aug 7 14:38:40 localhost xinetd[732]: EXIT: ftp pid=3924 duration=16(sec)
Aug 7 14:38:40 localhost xinetd[732]: EXIT: ftp pid=3923 duration=19(sec)
Aug 7 14:38:41 localhost xinetd[732]: START: ftp pid=3932 from=219.157.115.14
Aug 7 14:38:41 localhost xinetd[732]: EXIT: ftp pid=3929 duration=5(sec)
Aug 7 14:38:46 localhost xinetd[732]: EXIT: ftp pid=3930 duration=10(sec)
Aug 7 14:38:49 localhost xinetd[732]: EXIT: ftp pid=3932 duration=8(sec)
Aug 7 14:38:51 localhost xinetd[732]: EXIT: ftp pid=3931 duration=13(sec)
Aug 7 14:42:14 localhost xinetd[732]: START: ftp pid=3937 from=219.157.115.14
Aug 7 14:42:21 localhost xinetd[732]: EXIT: ftp pid=3937 duration=7(sec)
Aug 7 14:42:29 localhost xinetd[732]: START: ftp pid=3939 from=219.157.115.14
Aug 7 14:42:35 localhost xinetd[732]: EXIT: ftp pid=3939 duration=6(sec)
Aug 7 16:48:49 localhost sshd[721]: Server listening on 0.0.0.0 port 22.
Aug 7 17:10:30 localhost xinetd[741]: START: ftp pid=1009 from=219.157.115.14
Aug 7 17:10:30 localhost xinetd[741]: START: ftp pid=1010 from=219.157.115.14
Aug 7 17:10:33 localhost xinetd[741]: EXIT: ftp pid=1010 duration=3(sec)
Aug 7 17:10:37 localhost xinetd[741]: START: ftp pid=1012 from=219.157.115.14
Aug 7 17:10:40 localhost xinetd[741]: EXIT: ftp pid=1012 duration=3(sec)
Aug 7 17:10:41 localhost xinetd[741]: EXIT: ftp pid=1009 duration=11(sec)
Aug 7 17:10:46 localhost xinetd[741]: START: ftp pid=1018 from=219.157.115.14
Aug 7 17:10:46 localhost xinetd[741]: START: ftp pid=1019 from=219.157.115.14
Aug 7 17:10:46 localhost xinetd[741]: START: ftp pid=1020 from=219.157.115.14
Aug 7 17:10:50 localhost xinetd[741]: EXIT: ftp pid=1019 duration=4(sec)
Aug 7 17:10:52 localhost xinetd[741]: START: ftp pid=1025 from=219.157.115.14
Aug 7 17:10:53 localhost xinetd[741]: START: ftp pid=1026 from=219.157.115.14
Aug 7 17:10:55 localhost xinetd[741]: START: ftp pid=1028 from=219.157.115.14
Aug 7 17:11:00 localhost xinetd[741]: EXIT: ftp pid=1020 duration=14(sec)
Aug 7 17:11:00 localhost xinetd[741]: START: ftp pid=1032 from=219.157.115.14
Aug 7 17:11:04 localhost xinetd[741]: START: ftp pid=1033 from=219.157.115.14
Aug 7 17:11:07 localhost xinetd[741]: EXIT: ftp pid=1018 duration=21(sec)
Aug 7 17:11:07 localhost xinetd[741]: START: ftp pid=1034 from=219.157.115.14
Aug 7 17:11:09 localhost xinetd[741]: EXIT: ftp pid=1026 duration=16(sec)
Aug 7 17:11:12 localhost xinetd[741]: EXIT: ftp pid=1025 duration=20(sec)
Aug 7 17:11:12 localhost xinetd[741]: EXIT: ftp pid=1033 duration=8(sec)
Aug 7 17:11:12 localhost xinetd[741]: EXIT: ftp pid=1032 duration=12(sec)
Aug 7 17:11:13 localhost xinetd[741]: EXIT: ftp pid=1028 duration=18(sec)
Aug 7 17:11:13 localhost xinetd[741]: START: ftp pid=1035 from=219.157.115.14
Aug 7 17:11:22 localhost xinetd[741]: EXIT: ftp pid=1034 duration=15(sec)
Aug 7 17:11:23 localhost xinetd[741]: EXIT: ftp pid=1035 duration=10(sec)
Aug 7 17:11:23 localhost xinetd[741]: START: ftp pid=1036 from=219.157.115.14
Aug 7 17:11:37 localhost xinetd[741]: EXIT: ftp pid=1036 duration=14(sec)
Aug 7 17:11:38 localhost xinetd[741]: START: ftp pid=1037 from=219.157.115.14
Aug 7 17:11:38 localhost xinetd[741]: START: ftp pid=1038 from=219.157.115.14
Aug 7 17:11:44 localhost xinetd[741]: START: ftp pid=1039 from=219.157.115.14
Aug 7 17:11:44 localhost xinetd[741]: START: ftp pid=1040 from=219.157.115.14
Aug 7 17:11:54 localhost xinetd[741]: EXIT: ftp pid=1038 duration=16(sec)
Aug 7 17:11:55 localhost xinetd[741]: EXIT: ftp pid=1037 duration=17(sec)
Aug 7 17:11:56 localhost xinetd[741]: START: ftp pid=1041 from=219.157.115.14
Aug 7 17:11:56 localhost xinetd[741]: START: ftp pid=1042 from=219.157.115.14
Aug 7 17:11:58 localhost xinetd[741]: EXIT: ftp pid=1039 duration=14(sec)
Aug 7 17:11:58 localhost xinetd[741]: EXIT: ftp pid=1040 duration=14(sec)
Aug 7 17:12:09 localhost xinetd[741]: EXIT: ftp pid=1041 duration=13(sec)
Aug 7 17:12:16 localhost xinetd[741]: START: ftp pid=1043 from=219.157.115.14
Aug 7 17:12:16 localhost xinetd[741]: START: ftp pid=1044 from=219.157.115.14
Aug 7 17:12:19 localhost xinetd[741]: EXIT: ftp pid=1042 duration=23(sec)
Aug 7 17:12:19 localhost xinetd[741]: START: ftp pid=1045 from=219.157.115.14
Aug 7 17:12:23 localhost xinetd[741]: START: ftp pid=1046 from=219.157.115.14
Aug 7 17:12:25 localhost xinetd[741]: START: ftp pid=1047 from=219.157.115.14
Aug 7 17:12:27 localhost xinetd[741]: START: ftp pid=1048 from=219.157.115.14
Aug 7 17:12:28 localhost xinetd[741]: START: ftp pid=1050 from=219.157.115.14
Aug 7 17:12:30 localhost xinetd[741]: EXIT: ftp pid=1043 duration=14(sec)
Aug 7 17:12:30 localhost xinetd[741]: EXIT: ftp pid=1045 duration=11(sec)
Aug 7 17:12:30 localhost xinetd[741]: START: ftp pid=1051 from=219.157.115.14
Aug 7 17:12:31 localhost xinetd[741]: EXIT: ftp pid=1044 duration=15(sec)
Aug 7 17:12:31 localhost xinetd[741]: START: ftp pid=1052 from=219.157.115.14
Aug 7 17:12:33 localhost xinetd[741]: START: ftp pid=1053 from=219.157.115.14
Aug 7 17:12:33 localhost xinetd[741]: START: ftp pid=1055 from=219.157.115.14
Aug 7 17:12:35 localhost xinetd[741]: START: ftp pid=1056 from=219.157.115.14
Aug 7 17:12:35 localhost xinetd[741]: START: ftp pid=1057 from=219.157.115.14
Aug 7 17:12:36 localhost xinetd[741]: EXIT: ftp pid=1053 duration=3(sec)
Aug 7 17:12:36 localhost sshd[1054]: Did not receive identification string from 219.157.115.14.
Aug 7 17:12:37 localhost xinetd[741]: START: ftp pid=1058 from=219.157.115.14
Aug 7 17:12:37 localhost xinetd[741]: START: ftp pid=1059 from=219.157.115.14
Aug 7 17:12:38 localhost xinetd[741]: EXIT: ftp pid=1046 duration=15(sec)
Aug 7 17:12:38 localhost xinetd[741]: START: ftp pid=1060 from=219.157.115.14
Aug 7 17:12:41 localhost xinetd[741]: EXIT: ftp pid=1052 duration=10(sec)
Aug 7 17:12:43 localhost xinetd[741]: EXIT: ftp pid=1050 duration=15(sec)
Aug 7 17:12:46 localhost xinetd[741]: EXIT: ftp pid=1048 duration=19(sec)
Aug 7 17:12:46 localhost xinetd[741]: START: ftp pid=1061 from=219.157.115.14
Aug 7 17:12:46 localhost xinetd[741]: EXIT: ftp pid=1060 duration=8(sec)
Aug 7 17:12:46 localhost xinetd[741]: EXIT: ftp pid=1047 duration=21(sec)
Aug 7 17:12:47 localhost xinetd[741]: EXIT: ftp pid=1051 duration=17(sec)
Aug 7 17:12:47 localhost xinetd[741]: START: ftp pid=1062 from=219.157.115.14
Aug 7 17:12:47 localhost xinetd[741]: EXIT: ftp pid=1057 duration=12(sec)
Aug 7 17:12:50 localhost xinetd[741]: EXIT: ftp pid=1055 duration=17(sec)
Aug 7 17:12:50 localhost xinetd[741]: START: ftp pid=1063 from=219.157.115.14
Aug 7 17:12:51 localhost xinetd[741]: START: ftp pid=1064 from=219.157.115.14
Aug 7 17:12:51 localhost xinetd[741]: EXIT: ftp pid=1059 duration=14(sec)
Aug 7 17:12:51 localhost xinetd[741]: EXIT: ftp pid=1058 duration=14(sec)
Aug 7 17:12:54 localhost xinetd[741]: EXIT: ftp pid=1056 duration=19(sec)
Aug 7 17:12:57 localhost xinetd[741]: EXIT: ftp pid=1062 duration=10(sec)
Aug 7 17:12:59 localhost xinetd[741]: EXIT: ftp pid=1061 duration=13(sec)
Aug 7 17:13:03 localhost xinetd[741]: EXIT: ftp pid=1064 duration=12(sec)
Aug 7 17:13:04 localhost xinetd[741]: EXIT: ftp pid=1063 duration=14(sec)
Aug 8 08:40:09 localhost xinetd[741]: START: ftp pid=2009
219.157.115.176
219.157.115.85
Aug 10 02:31:07 localhost sshd[4411]: Did not receive identification string from 218.247.203.105.
Aug 10 02:31:13 localhost sshd[4412]: Did not receive identification string from 218.247.203.105.
……

Answer 1

up

Answer 2

我们的服务器也有这样的日志，我觉得是有人在猜测密码，并没有登陆成功。不知道对否，等高人指点！！！

Answer 3

是有人在进行攻击 ，用iptables drop掉 对方的ip

Answer 4

ip不是一个,我想可能是有人利用IP地址欺诈在进行攻击.因为现在这台服务器上FTP巨慢.

Answer 5

该如何做？

Answer 6

大侠　们　我也想知道？

Answer 7

[quote]原帖由 "好好先生"]ip不是一个,我想可能是有人利用IP地址欺诈在进行攻击.因为现在这台服务器上FTP巨慢.[/quote 发表：
     

IP欺骗应该无法对FTP进行攻击，应为建立不起连接。DDOS倒是很像。

Answer 8

那么应该如何防范？也用iptables吗？该如何写语句？

Answer 9

up.