有人試圖入侵我的伺服器

我有一台 linux 機器作為測試伺服器執行。我的盒子直接在這台機器上重定向我的埠，比如 80。我創建它來訓練所有類型的東西（raid，tcp …）。

最近我嘗試在 VNC 中連接到我的機器，我得到一個錯誤“太多的身份驗證失敗”，所以我檢查了日誌，我得到了一個可怕的驚喜；有人試圖通過 VNC 中的蠻力連接到我的機器。這是此日誌的簡短摘錄：

04/01/17 13:53:56 Got connection from client 111.73.46.90
04/01/17 13:53:56 Using protocol version 3.3
04/01/17 13:53:56 Too many authentication failures - client rejected
04/01/17 13:53:56 Client 111.73.46.90 gone
04/01/17 13:53:56 Statistics:
04/01/17 13:53:56   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:53:57 Got connection from client 111.73.46.90
04/01/17 13:53:57 Using protocol version 3.3
04/01/17 13:53:57 Too many authentication failures - client rejected
04/01/17 13:53:57 Client 111.73.46.90 gone
04/01/17 13:53:57 Statistics:
04/01/17 13:53:57   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:54:26 Got connection from client 111.73.46.90
04/01/17 13:54:26 Using protocol version 3.3
04/01/17 13:54:26 Too many authentication failures - client rejected
04/01/17 13:54:26 Client 111.73.46.90 gone
04/01/17 13:54:26 Statistics:
04/01/17 13:54:26   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:56:07 Got connection from client 111.73.46.90
04/01/17 13:56:07 Using protocol version 3.3
04/01/17 13:56:07 Too many authentication failures - client rejected
04/01/17 13:56:07 Client 111.73.46.90 gone
04/01/17 13:56:07 Statistics:
04/01/17 13:56:07   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:56:08 Got connection from client 111.73.46.90
04/01/17 13:56:08 Using protocol version 3.3
04/01/17 13:56:08 Too many authentication failures - client rejected
04/01/17 13:56:08 Client 111.73.46.90 gone
04/01/17 13:56:08 Statistics:
04/01/17 13:56:08   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:56:43 Got connection from client 111.73.46.90
04/01/17 13:56:43 Using protocol version 3.3
04/01/17 13:56:43 Too many authentication failures - client rejected
04/01/17 13:56:43 Client 111.73.46.90 gone
04/01/17 13:56:43 Statistics:
04/01/17 13:56:43   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:57:52 Got connection from client 111.73.46.90
04/01/17 13:57:54 Using protocol version 3.3
04/01/17 13:57:54 Too many authentication failures - client rejected
04/01/17 13:57:54 Client 111.73.46.90 gone
04/01/17 13:57:54 Statistics:
04/01/17 13:57:54   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 13:59:22 Got connection from client 111.73.46.90
04/01/17 13:59:22 Using protocol version 3.3
04/01/17 13:59:22 Too many authentication failures - client rejected
04/01/17 13:59:22 Client 111.73.46.90 gone
04/01/17 13:59:22 Statistics:
04/01/17 13:59:22   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 14:01:20 Got connection from client 111.73.46.90
04/01/17 14:01:21 Using protocol version 3.3
04/01/17 14:01:21 Too many authentication failures - client rejected
04/01/17 14:01:21 Client 111.73.46.90 gone
04/01/17 14:01:21 Statistics:
04/01/17 14:01:21   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 14:03:48 Got connection from client 111.73.46.90
04/01/17 14:03:49 Using protocol version 3.3
04/01/17 14:03:49 Too many authentication failures - client rejected
04/01/17 14:03:49 Client 111.73.46.90 gone
04/01/17 14:03:49 Statistics:
04/01/17 14:03:49   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 14:06:51 Got connection from client 111.73.46.90
04/01/17 14:06:51 Using protocol version 3.3
04/01/17 14:06:51 Too many authentication failures - client rejected
04/01/17 14:06:51 Client 111.73.46.90 gone
04/01/17 14:06:51 Statistics:
04/01/17 14:06:51   framebuffer updates 0, rectangles 0, bytes 0

04/01/17 14:10:18 Got connection from client 111.73.46.90
04/01/17 14:10:20 Using protocol version 3.3
04/01/17 14:10:20 Too many authentication failures - client rejected
04/01/17 14:10:20 Client 111.73.46.90 gone
04/01/17 14:10:20 Statistics:
04/01/17 14:10:20   framebuffer updates 0, rectangles 0, bytes 0

就像 29/12/16 一樣，但我認為日誌文件不會進一步保存。

我還檢查了 ssh，我也有同樣的事情：

Jan  3 15:18:00 raspberrypi sshd[24434]: Invalid user alan from 193.248.133.13
Jan  3 16:14:38 raspberrypi sshd[24797]: Invalid user vnc from 46.105.137.2
Jan  3 16:36:33 raspberrypi sshd[24951]: Invalid user user from 107.151.213.61
Jan  3 16:36:46 raspberrypi sshd[24956]: Invalid user user from 107.151.213.61
Jan  3 16:37:01 raspberrypi sshd[24965]: Invalid user admin from 107.151.213.61
Jan  3 16:37:18 raspberrypi sshd[24977]: Invalid user admin from 107.151.213.61
Jan  3 17:00:57 raspberrypi sshd[25128]: Invalid user admin from 182.37.8.7
Jan  3 17:07:48 raspberrypi sshd[25182]: Invalid user admin from 122.191.248.96
Jan  3 17:44:38 raspberrypi sshd[25546]: Invalid user admin from 51.15.59.6
Jan  3 17:44:58 raspberrypi sshd[25584]: Invalid user admin from 51.15.59.6
Jan  3 17:45:01 raspberrypi sshd[25588]: Invalid user guest from 51.15.59.6
Jan  3 17:45:02 raspberrypi sshd[25595]: Invalid user guest from 51.15.59.6
Jan  3 17:45:04 raspberrypi sshd[25599]: Invalid user support from 51.15.59.6
Jan  3 17:45:07 raspberrypi sshd[25603]: Invalid user user from 51.15.59.6
Jan  3 17:45:09 raspberrypi sshd[25607]: Invalid user admin from 51.15.59.6
Jan  3 17:45:16 raspberrypi sshd[25621]: Invalid user admin from 51.15.59.6
Jan  3 17:45:19 raspberrypi sshd[25625]: Invalid user test from 51.15.59.6
Jan  3 17:45:20 raspberrypi sshd[25629]: Invalid user vagrant from 51.15.59.6
Jan  3 17:45:25 raspberrypi sshd[25637]: Invalid user ubnt from 51.15.59.6
Jan  3 17:45:26 raspberrypi sshd[25641]: Invalid user guest from 51.15.59.6
Jan  3 17:45:29 raspberrypi sshd[25645]: Invalid user telnet from 51.15.59.6
Jan  3 17:50:33 raspberrypi sshd[25678]: Invalid user demo from 46.105.137.2
Jan  3 18:06:34 raspberrypi sshd[25853]: Invalid user ubnt from 67.204.49.5
Jan  3 19:10:52 raspberrypi sshd[26321]: Invalid user hello from 193.248.133.13
Jan  3 19:26:44 raspberrypi sshd[26435]: Invalid user ubuntu from 46.105.137.2
Jan  3 21:03:17 raspberrypi sshd[27099]: Invalid user ubuntu from 46.105.137.2
Jan  3 21:18:59 raspberrypi sshd[27236]: Invalid user ubnt from 163.172.233.70
Jan  3 21:19:15 raspberrypi sshd[27244]: Invalid user cusadmin from 163.172.233.70
Jan  3 21:19:38 raspberrypi sshd[27258]: Invalid user ts3 from 163.172.233.70
Jan  3 21:19:45 raspberrypi sshd[27262]: Invalid user tf2 from 163.172.233.70
Jan  3 21:19:53 raspberrypi sshd[27268]: Invalid user css from 163.172.233.70
Jan  3 21:20:00 raspberrypi sshd[27276]: Invalid user gmod from 163.172.233.70
Jan  3 21:20:08 raspberrypi sshd[27283]: Invalid user lgsm from 163.172.233.70
Jan  3 21:20:16 raspberrypi sshd[27287]: Invalid user starbound from 163.172.233.70
Jan  3 22:16:37 raspberrypi sshd[27663]: Invalid user admin from 123.31.34.216
Jan  3 22:16:42 raspberrypi sshd[27667]: Invalid user support from 123.31.34.216
Jan  3 22:40:04 raspberrypi sshd[27858]: Invalid user ubuntu from 46.105.137.2
Jan  3 22:41:51 raspberrypi sshd[27878]: Invalid user usuario from 219.140.230.198
Jan  3 23:15:37 raspberrypi sshd[28149]: Invalid user admin from 205.185.192.157
Jan  3 23:30:59 raspberrypi sshd[28279]: Invalid user admin from 179.233.94.73
Jan  4 00:16:13 raspberrypi sshd[28690]: Invalid user ubuntu from 46.105.137.2
Jan  4 01:50:24 raspberrypi sshd[29339]: Invalid user support from 193.248.133.13
Jan  4 01:52:23 raspberrypi sshd[29360]: Invalid user ubuntu from 46.105.137.2
Jan  4 02:05:31 raspberrypi sshd[29461]: Invalid user a from 213.229.108.216
Jan  4 02:05:40 raspberrypi sshd[29465]: Invalid user oracle from 213.229.108.216
Jan  4 02:30:18 raspberrypi sshd[29638]: Invalid user admin from 185.110.132.202
Jan  4 02:30:55 raspberrypi sshd[29647]: Invalid user tomcat7 from 193.248.133.13
Jan  4 02:42:14 raspberrypi sshd[29726]: Invalid user support from 185.110.132.202
Jan  4 02:48:08 raspberrypi sshd[29771]: Invalid user user from 185.110.132.202
Jan  4 02:53:58 raspberrypi sshd[29814]: Invalid user test from 185.110.132.202
Jan  4 02:59:49 raspberrypi sshd[29863]: Invalid user guest from 185.110.132.202
Jan  4 03:05:49 raspberrypi sshd[29911]: Invalid user anonymous from 185.110.132.202
Jan  4 03:11:35 raspberrypi sshd[29950]: Invalid user reception from 193.248.133.13
Jan  4 03:11:42 raspberrypi sshd[29956]: Invalid user ubnt from 185.110.132.202
Jan  4 03:17:38 raspberrypi sshd[29998]: Invalid user dlink from 185.110.132.202
Jan  4 03:23:25 raspberrypi sshd[30065]: Invalid user admin from 185.110.132.202
Jan  4 03:29:11 raspberrypi sshd[30146]: Invalid user ubuntu from 46.105.137.2
Jan  4 03:29:12 raspberrypi sshd[30150]: Invalid user admin from 185.110.132.202
Jan  4 04:42:36 raspberrypi sshd[30965]: Invalid user admin from 37.78.244.206
Jan  4 05:00:29 raspberrypi sshd[31105]: Invalid user admin from 8.26.21.218
Jan  4 05:00:31 raspberrypi sshd[31109]: Invalid user admin from 8.26.21.218
Jan  4 05:00:34 raspberrypi sshd[31113]: Invalid user test from 8.26.21.218
Jan  4 05:00:37 raspberrypi sshd[31117]: Invalid user guest from 8.26.21.218
Jan  4 05:00:40 raspberrypi sshd[31121]: Invalid user user from 8.26.21.218
Jan  4 05:00:43 raspberrypi sshd[31126]: Invalid user admin from 8.26.21.218
Jan  4 05:00:46 raspberrypi sshd[31130]: Invalid user admin from 8.26.21.218
Jan  4 05:00:52 raspberrypi sshd[31138]: Invalid user ubnt from 8.26.21.218
Jan  4 05:05:30 raspberrypi sshd[31173]: Invalid user ubuntu from 46.105.137.2
Jan  4 05:37:33 raspberrypi sshd[31404]: Invalid user admin from 122.189.192.75
Jan  4 06:29:09 raspberrypi sshd[31863]: Invalid user admin from 193.248.133.13
Jan  4 06:42:03 raspberrypi sshd[31957]: Invalid user ubuntu from 46.105.137.2
Jan  4 07:38:42 raspberrypi sshd[32641]: Invalid user admin from 175.20.94.253
Jan  4 09:17:42 raspberrypi sshd[1875]: Invalid user festival from 202.100.245.12
Jan  4 09:51:57 raspberrypi sshd[2482]: Invalid user admin from 95.30.228.51
Jan  4 09:51:58 raspberrypi sshd[2486]: Invalid user admin from 95.30.228.51
Jan  4 09:55:53 raspberrypi sshd[2562]: Invalid user ubuntu from 46.105.137.2
Jan  4 09:59:22 raspberrypi sshd[2652]: Invalid user ts from 70.35.196.91
Jan  4 10:44:10 raspberrypi sshd[3576]: Invalid user hadoop from 70.35.196.91
Jan  4 10:46:54 raspberrypi sshd[3646]: Invalid user admin from 95.215.60.223
Jan  4 10:46:57 raspberrypi sshd[3654]: Invalid user test from 95.215.60.223
Jan  4 10:47:00 raspberrypi sshd[3658]: Invalid user guest from 95.215.60.223
Jan  4 10:47:02 raspberrypi sshd[3662]: Invalid user user from 95.215.60.223
Jan  4 10:47:05 raspberrypi sshd[3667]: Invalid user admin from 95.215.60.223
Jan  4 10:47:08 raspberrypi sshd[3671]: Invalid user admin from 95.215.60.223
Jan  4 11:28:28 raspberrypi sshd[4525]: Invalid user username from 70.35.196.91
Jan  4 11:32:48 raspberrypi sshd[4605]: Invalid user ubuntu from 46.105.137.2
Jan  4 11:43:17 raspberrypi sshd[4794]: Invalid user xbian from 193.248.133.13
Jan  4 13:09:55 raspberrypi sshd[6034]: Invalid user ubuntu from 46.105.137.2
Jan  4 13:14:49 raspberrypi sshd[6061]: Invalid user admin from 115.239.230.222
Jan  4 13:14:58 raspberrypi sshd[6070]: Invalid user admin from 115.239.230.222
Jan  4 14:09:44 raspberrypi sshd[6937]: Invalid user admin from 218.108.215.128

我用一個站點檢查了 ip 位置（不知道我是否可以相信結果？）它來自美國和中國。我認為他正在使用VPN。

我能做些什麼 ？我剛剛關閉了我的機器，但我正在尋找更好的解決方案……我能知道是誰嗎？我可以提出索賠嗎？或者甚至只是阻止他試圖入侵我？

感謝您的回答。

首先，不要驚慌。檢查是否發生了任何實際登錄。

如果有，恐慌。

如果沒有，一切仍然正常。有許多機器試圖在他們能找到的每台機器上使用常見的使用者/密碼組合和安全漏洞，以竊取數據或使殭屍網路變得更大。

因此，登錄嘗試本身並不令人驚訝，只是您必須處理的事情。那麼如何才能真正讓您的機器更安全呢？

遵循強化軟體的最佳實踐

這些因軟體而異。對於 SSH，最常見的事情是：

• 禁用root登錄
• 禁用鍵盤身份驗證

每個腳本都會嘗試使用 root、user、guest、backup、monitoring、nagios、icinga、veeam 等使用者名登錄。那裡有常用名稱列表，腳本只是遍歷它們。例如，Google搜尋顯示了這一點。使用不在您列表中的使用者名，例如您的真實姓名。

僅使用 SSH 密鑰登錄也使得暴力破解密碼幾乎是不可能的。

只向網際網路公開必要的服務

無法從 Internet 訪問的服務無法從 Internet 進行攻擊。如果您的機器上有一個數據庫伺服器，但只在內部需要它，則沒有理由將埠暴露給外部。如果其他機器需要通過 Internet 訪問它，請明確允許這些 IP。事實上，您應該預設丟棄所有流量，只打開特別需要的埠，例如 80 或 22。

請參閱此處以獲取 iptables 配置範例：對於特定埠/ip 對使用 ACCEPT 然後 DROP 是否允許該 ip 但該埠上沒有其他內容？

實施限速

特別是在您可以登錄的服務上，您應該安裝某種形式的速率限制。如果發生了一定次數的不成功登錄嘗試，則應阻止該 IP。linux 實現這一點最常用的軟體可能是fail2ban。它有各種軟體的預設，你可以簡單地啟動它，讓你高枕無憂。

更改預設埠

這通常不被認為是最佳實踐，主要是因為它需要與組織的其他部分進行通信，例如 SSH 現在是埠 56298，而不是眾所周知的 22。開放埠也可以通過埠掃描來檢測。但是，埠 22 上的自動登錄嘗試比埠掃描更頻繁。如果您這樣做，最簡單的攻擊腳本只會失敗。它對專門的攻擊者沒有幫助。

引用自：https://serverfault.com/questions/824100