我的服务器受到了攻击，怎么办？

macson

我在观察系统安全日志的时候，一直发现有人在不断的连接我的服务器，
尝试用不同的密码来登录服务器，请问我该如何应付这种情况呢？
[PHP]

      May 30 08:38:57 myserver sshd[2751]: Did not receive identification string from 218.241.83.79
      May 30 08:42:29 myserver sshd[2772]: Invalid user staff from 218.241.83.79
      May 30 00:42:29 myserver sshd[2775]: input_userauth_request: invalid user staff
      May 30 08:42:29 myserver sshd[2772]: pam_unix(sshd:auth): check pass; user unknown
      May 30 08:42:29 myserver sshd[2772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.83.79
      May 30 08:42:29 myserver sshd[2772]: pam_succeed_if(sshd:auth): error retrieving information about user staff
      May 30 08:42:31 myserver sshd[2772]: Failed password for invalid user staff from 218.241.83.79 port 46406 ssh2
      May 30 00:42:31 myserver sshd[2775]: Failed password for invalid user staff from 218.241.83.79 port 46406 ssh2
      May 30 00:42:31 myserver sshd[2775]: Received disconnect from 218.241.83.79: 11: Bye Bye
      May 30 08:42:36 myserver sshd[2777]: Invalid user sales from 218.241.83.79
      May 30 00:42:36 myserver sshd[2780]: input_userauth_request: invalid user sales
      May 30 08:42:36 myserver sshd[2777]: pam_unix(sshd:auth): check pass; user unknown
      May 30 08:42:36 myserver sshd[2777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.83.79
      May 30 08:42:36 myserver sshd[2777]: pam_succeed_if(sshd:auth): error retrieving information about user sales
      May 30 08:42:38 myserver sshd[2777]: Failed password for invalid user sales from 218.241.83.79 port 47507 ssh2
      May 30 00:42:38 myserver sshd[2780]: Failed password for invalid user sales from 218.241.83.79 port 47507 ssh2
      May 30 00:42:38 myserver sshd[2780]: Received disconnect from 218.241.83.79: 11: Bye Bye
      May 30 08:42:44 myserver sshd[2781]: Invalid user recruit from 218.241.83.79
      May 30 00:42:54 myserver sshd[2784]: input_userauth_request: invalid user recruit
      May 30 08:42:54 myserver sshd[2781]: pam_unix(sshd:auth): check pass; user unknown
      May 30 08:42:54 myserver sshd[2781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.83.79
      May 30 08:42:54 myserver sshd[2781]: pam_succeed_if(sshd:auth): error retrieving information about user recruit
      May 30 08:42:56 myserver sshd[2781]: Failed password for invalid user recruit from 218.241.83.79 port 48083 ssh2
      May 30 00:42:56 myserver sshd[2784]: Failed password for invalid user recruit from 218.241.83.79 port 48083 ssh2
      May 30 00:42:56 myserver sshd[2784]: Connection closed by 218.241.83.79
      May 30 09:49:25 myserver su: pam_unix(su:session): session closed for user root
      May 30 11:29:50 myserver sshd[7898]: Did not receive identification string from 221.11.140.231
      May 30 11:55:26 myserver sshd[9841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:55:29 myserver sshd[9841]: Failed password for root from 59.52.28.136 port 33517 ssh2
      May 30 03:55:29 myserver sshd[9844]: Failed password for root from 59.52.28.136 port 33517 ssh2
      May 30 03:55:29 myserver sshd[9844]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:55:35 myserver sshd[9860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:55:36 myserver sshd[9860]: Failed password for root from 59.52.28.136 port 34053 ssh2
      May 30 03:55:36 myserver sshd[9863]: Failed password for root from 59.52.28.136 port 34053 ssh2
      May 30 03:55:36 myserver sshd[9863]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:55:42 myserver sshd[9877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:55:44 myserver sshd[9877]: Failed password for root from 59.52.28.136 port 34444 ssh2
      May 30 03:55:44 myserver sshd[9880]: Failed password for root from 59.52.28.136 port 34444 ssh2
      May 30 03:55:44 myserver sshd[9880]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:55:50 myserver sshd[9903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:55:52 myserver sshd[9903]: Failed password for root from 59.52.28.136 port 34849 ssh2
      May 30 03:55:52 myserver sshd[9906]: Failed password for root from 59.52.28.136 port 34849 ssh2
      May 30 03:55:52 myserver sshd[9906]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:55:58 myserver sshd[9924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:00 myserver sshd[9924]: Failed password for root from 59.52.28.136 port 35242 ssh2
      May 30 03:56:00 myserver sshd[9927]: Failed password for root from 59.52.28.136 port 35242 ssh2
      May 30 03:56:00 myserver sshd[9927]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:56:05 myserver sshd[9946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:08 myserver sshd[9946]: Failed password for root from 59.52.28.136 port 35587 ssh2
      May 30 03:56:08 myserver sshd[9950]: Failed password for root from 59.52.28.136 port 35587 ssh2
      May 30 03:56:08 myserver sshd[9950]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:56:13 myserver sshd[9963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:15 myserver sshd[9963]: Failed password for root from 59.52.28.136 port 36048 ssh2
      May 30 03:56:15 myserver sshd[9966]: Failed password for root from 59.52.28.136 port 36048 ssh2
      May 30 03:56:15 myserver sshd[9966]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:56:21 myserver sshd[9984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:23 myserver sshd[9984]: Failed password for root from 59.52.28.136 port 36494 ssh2
      May 30 03:56:23 myserver sshd[9987]: Failed password for root from 59.52.28.136 port 36494 ssh2
      May 30 03:56:23 myserver sshd[9987]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:56:28 myserver sshd[10001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:31 myserver sshd[10001]: Failed password for root from 59.52.28.136 port 36949 ssh2
      May 30 03:56:31 myserver sshd[10004]: Failed password for root from 59.52.28.136 port 36949 ssh2
      May 30 03:56:31 myserver sshd[10004]: Received disconnect from 59.52.28.136: 11: Bye Bye
      May 30 11:56:45 myserver sshd[10017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.52.28.136 user=root
      May 30 11:56:47 myserver sshd[10017]: Failed password for root from 59.52.28.136 port 37420 ssh2
[/PHP]

konds

换个用户作root用吧 有root用户就总有这样的信息的

晨想

不允许 root 用户登录，再怎么破也没用。。。。。。

macson

我现在贴出来的只是刚好那个家伙在用root进行尝试而已，我的系统本来就是不允许root直接登录的。
但是他还是会用其他的用户来不断尝试的，有没有什么自动监测的手段可以消灭这种攻击或尝试?

abc1239

没办法，你走在马路上，不能要求别人不许看你：）

blackwhite

你可以用脚本规定3次失败，就封IP。

caigao

我的解决办法是使用swatch和iptables结合.

到网上找一找swatch有很多相关文章.

注意,安装swatch时需要很多类如
Time::HiRes
Date::Calc
Date::Format
File::Tail
Date:arse
之类的东东,

这些都是Perl的可选模块,请用以下方法安装(有些模块在yum里面找不到)
perl -MCPAN -e "shell"
install Some::Module

这些必要的模块安装好了以后再到

rpm.phone.net上找与你的OS对应的swatch安装程序(RPM格式)

安装时加-nodeps参数,

安装好以后再进行设置,设置中发现有人恶意登陆还可以给自己发邮件呢.

我现在的设置是当用户通过ssh登陆一次不成功就立即添加到防火墙,所以以后自己登陆时要小心.!

以下是我的设置:

1. 
   
2. 
   
3. # Global swatch filter file
   
4. 
   
5. # To ignore a IP-range
   
6. # ignore /216\.239\.37\./
   
7. 
   
8. # Invalid SSH Login Attempts
   
9. watchfor /(: [iI]nvalid [uU]ser )(.*)( from ::ffff:)(.*)$/
   
10.         throttle threshold=3,delay=0:1:0,key=$4
    
11.         mail addresses=xxx\@vip.sina.com,subject="SSH:\ Invalid\ User\ Rule1\ $4"
    
12.         exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"
    
13. 
    
14. # Failed SSH Login Attempts
    
15. watchfor /(: [fF]ailed password for )(.*)( from ::ffff:)(.*)( port )(.*)$/
    
16.         throttle threshold=3,delay=0:1:0,key=$4
    
17.         mail addresses=xxxx\@vip.sina.com,subject="SSH:\ Invalid\ User\ Rule2\ $4"
    
18.         exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"
    
19. 
    
20. # Invalid SSH Login Attempts. Another one - just formed differently
    
21. # watchfor /([aA]uthentication [fF]ailure; logname)(.*)(rhost=)(\d+\.\d+\.\d+\.\d+)(.*)$/
    
22. #        throttle threshold=3,delay=0:1:0,key=$4
    
23. #        mail addresses=xxxx\@vip.sina.com,subject="SSH:\ Invalid\ User\ Rule3\ $4"
    
24. #        exec "/sbin/iptables -A swatch_rejects -s $4 -j DROP"
    
25. 
    

复制代码

然后在/etc/rc.d/rc.sysinit中添加
# /usr/bin/swatch --tail-file=/var/log/messages --tail-args='--follow=name --lines=1' --config-file=/etc/swatch/ssh-swatch.conf --pid-file=/var/run/swatch.pid --daemon
或者使用下面的服务启动:

1. 
   
2. #!/bin/bash
   
3. #
   
4. # swatch           This shell script enables the automatic use of YUM
   
5. #
   
6. # Author:       Seth Vidal <skvidal@phy.duke.edu>
   
7. #
   
8. # chkconfig:    2345 11 91
   
9. #
   
10. # description:  Enable daily run of yum, a program updater.
    
11. # processname:  swatch
    
12. # config: /etc/swatch/ssh-swatch.conf
    
13. 
    
14. pid=`/bin/ps -e -o cmd,pid | /bin/grep ^swatch | /bin/awk '{print $2}'`
    
15. 
    
16. case "$1" in
    
17. 'start')
    
18. # start the swatch process
    
19. 
    
20. if [ "$pid" != "" ];
    
21. then
    
22. echo 'Swatch System is already initialized.'
    
23. exit 0
    
24. fi
    
25. if [ -f /usr/bin/swatch -a -f /etc/swatch/ssh-swatch.conf ];
    
26. then /usr/bin/swatch --config-file=/etc/swatch/ssh-swatch.conf --tail-file=/var/log/messages --tail-args='--follow=name --lines=1' --pid-file=/var/run/swatch.pid --daemon &
    
27. exit
    
28. fi
    
29. echo 'Swatch System startup complete.' ;;
    
30. 'stop')
    
31. 
    
32. #stop all swatch processes
    
33. if [ "$pid" != "" ];
    
34. then kill -TERM $pid
    
35. ##/usr/bin/killall tail
    
36. echo 'Swatch System shutdown complete.'
    
37. else
    
38. echo 'No Swatch System initialized.'
    
39. fi ;;
    
40. *)
    
41. echo "Usage: /etc/init.d/swatch { start | stop }" ;;
    
42. esac
    
43. 
    

复制代码

你就大功告成啦............................



参考网址:
http://gentoo-wiki.com/HOWTO_Protect_SSHD_with_Swatch

http://www.trustix.org/wiki/index.php/Swatch



预祝你的LINUX愉快之旅!!!

macson

谢谢老大，我立刻试试看

aleng

我的认为是：

open ssh 版本要最新，就用ssh2+root登录，不用密码，方便。
ssh2不是用 1024位的密钥对么？随便让他试验那，大不了2-3个月换一对密钥，换协议也行

我认为服务器，最大的隐患是php代码，次之是mysql和linux漏洞
除了上面的。
我用脚丫子想也知道你服务器 ，已知的linux漏洞你服务器肯定有，因为 90%的人根本不知道每月要补漏洞，他们从不打补丁，还在那幻想 linux比win安全。

说说 你的发行版，你都打了什么安全补丁，大家也探讨一下。

晨想

允许 root 登录是绝对不是一个好策略。至少也要用普通用户登录后，再 su 为 root。

至于密钥这个登录方法，不错，就是要把密钥文件保管好。呵呵。