谁这么无聊啊，一直登陆我的SSH，黑客吗？

xie***

谁这么无聊啊，一直登陆我的SSH，黑客吗？看IP有国外的，有国内的百度云和腾讯云的，这是在爆破我的路由器吗？国外的管不了，国内的百度云和腾讯云的IP是否可以举报呢？？


May 29 08:47:31 sshd[11369]: Invalid user dani from 180.76.105.81 port 48428
May 29 08:47:31 sshd[11369]: error: Could not get shadow information for NOUSER
May 29 08:47:31 sshd[11369]: Failed password for invalid user dani from 180.76.105.81 port 48428 ssh2
May 29 08:47:31 sshd[11369]: Received disconnect from 180.76.105.81 port 48428:11: Bye Bye [preauth]
May 29 08:47:31 sshd[11369]: Disconnected from invalid user dani 180.76.105.81 port 48428 [preauth]
May 29 08:47:36 sshd[11371]: Invalid user root from 92.222.75.41 port 41086
May 29 08:47:36 sshd[11371]: error: Could not get shadow information for NOUSER
May 29 08:47:36 sshd[11371]: Failed password for invalid user root from 92.222.75.41 port 41086 ssh2
May 29 08:47:37 sshd[11371]: Received disconnect from 92.222.75.41 port 41086:11: Bye Bye [preauth]
May 29 08:47:37 sshd[11371]: Disconnected from invalid user root 92.222.75.41 port 41086 [preauth]
May 29 08:47:38 sshd[11367]: error: Could not get shadow information for NOUSER
May 29 08:47:41 sshd[11373]: Invalid user root from 64.227.10.112 port 38174
May 29 08:47:41 sshd[11373]: error: Could not get shadow information for NOUSER
May 29 08:47:41 sshd[11373]: Failed password for invalid user root from 64.227.10.112 port 38174 ssh2
May 29 08:47:42 sshd[11373]: Received disconnect from 64.227.10.112 port 38174:11: Bye Bye [preauth]
May 29 08:47:42 sshd[11373]: Disconnected from invalid user root 64.227.10.112 port 38174 [preauth]
May 29 08:47:43 sshd[11375]: Invalid user test from 92.222.92.64 port 43234
May 29 08:47:43 sshd[11375]: error: Could not get shadow information for NOUSER
May 29 08:47:43 sshd[11375]: Failed password for invalid user test from 92.222.92.64 port 43234 ssh2
May 29 08:47:44 sshd[11375]: Received disconnect from 92.222.92.64 port 43234:11: Bye Bye [preauth]
May 29 08:47:44 sshd[11375]: Disconnected from invalid user test 92.222.92.64 port 43234 [preauth]
May 29 08:48:18 sshd[11493]: Invalid user root from 59.63.163.49 port 43100
May 29 08:48:18 sshd[11493]: error: Could not get shadow information for NOUSER
May 29 08:48:18 sshd[11493]: Failed password for invalid user root from 59.63.163.49 port 43100 ssh2
May 29 08:48:18 sshd[11493]: Received disconnect from 59.63.163.49 port 43100:11: Bye Bye [preauth]
May 29 08:48:18 sshd[11493]: Disconnected from invalid user root 59.63.163.49 port 43100 [preauth]
May 29 08:48:25 sshd[11496]: Invalid user root from 148.70.183.43 port 47080
May 29 08:48:25 sshd[11496]: error: Could not get shadow information for NOUSER
May 29 08:48:25 sshd[11496]: Failed password for invalid user root from 148.70.183.43 port 47080 ssh2
May 29 08:48:25 sshd[11496]: Received disconnect from 148.70.183.43 port 47080:11: Bye Bye [preauth]
May 29 08:48:25 sshd[11496]: Disconnected from invalid user root 148.70.183.43 port 47080 [preauth]
May 29 08:48:29 sshd[11495]: Invalid user pwp\r from 103.124.145.34 port 51971
May 29 08:48:29 sshd[11495]: error: Could not get shadow information for NOUSER
May 29 08:48:29 sshd[11495]: Failed password for invalid user pwp\r from 103.124.145.34 port 51971 ssh2
May 29 08:48:29 sshd[11495]: Received disconnect from 103.124.145.34 port 51971:11: Bye Bye [preauth]
May 29 08:48:29 sshd[11495]: Disconnected from invalid user pwp\\r 103.124.145.34 port 51971 [preauth]
May 29 08:48:31 sshd[11499]: Invalid user oldani from 203.86.7.110 port 58912
May 29 08:48:31 sshd[11499]: error: Could not get shadow information for NOUSER
May 29 08:48:31 sshd[11499]: Failed password for invalid user oldani from 203.86.7.110 port 58912 ssh2
May 29 08:48:31 sshd[11499]: Received disconnect from 203.86.7.110 port 58912:11: Bye Bye [preauth]
May 29 08:48:31 sshd[11499]: Disconnected from invalid user oldani 203.86.7.110 port 58912 [preauth]
May 29 08:48:37 sshd[11501]: Invalid user 0321 from 49.233.173.90 port 33192
May 29 08:48:37 sshd[11501]: error: Could not get shadow information for NOUSER
May 29 08:48:37 sshd[11501]: Failed password for invalid user 0321 from 49.233.173.90 port 33192 ssh2
May 29 08:48:37 sshd[11501]: Received disconnect from 49.233.173.90 port 33192:11: Bye Bye [preauth]
May 29 08:48:37 sshd[11501]: Disconnected from invalid user 0321 49.233.173.90 port 33192 [preauth]
May 29 08:48:43 sshd[11503]: Invalid user root from 193.112.79.159 port 54008
May 29 08:48:43 sshd[11503]: error: Could not get shadow information for NOUSER
May 29 08:48:43 sshd[11503]: Failed password for invalid user root from 193.112.79.159 port 54008 ssh2
May 29 08:48:44 sshd[11503]: Received disconnect from 193.112.79.159 port 54008:11: Bye Bye [preauth]
May 29 08:48:44 sshd[11503]: Disconnected from invalid user root 193.112.79.159 port 54008 [preauth]
May 29 08:49:13 sshd[11505]: Invalid user root from 51.38.186.180 port 42568
May 29 08:49:13 sshd[11505]: error: Could not get shadow information for NOUSER
May 29 08:49:13 sshd[11505]: Failed password for invalid user root from 51.38.186.180 port 42568 ssh2
May 29 08:49:13 sshd[11505]: Received disconnect from 51.38.186.180 port 42568:11: Bye Bye [preauth]
May 29 08:49:13 sshd[11505]: Disconnected from invalid user root 51.38.186.180 port 42568 [preauth]
May 29 08:49:20 sshd[11507]: Invalid user root from 106.54.184.153 port 38114
May 29 08:49:20 sshd[11507]: error: Could not get shadow information for NOUSER
May 29 08:49:20 sshd[11507]: Failed password for invalid user root from 106.54.184.153 port 38114 ssh2
May 29 08:49:20 sshd[11507]: Received disconnect from 106.54.184.153 port 38114:11: Bye Bye [preauth]
May 29 08:49:20 sshd[11507]: Disconnected from invalid user root 106.54.184.153 port 38114 [preauth]
May 29 08:49:21 sshd[11509]: Invalid user root from 180.76.105.81 port 46154
May 29 08:49:21 sshd[11509]: error: Could not get shadow information for NOUSER
May 29 08:49:21 sshd[11509]: Failed password for invalid user root from 180.76.105.81 port 46154 ssh2
May 29 08:49:21 sshd[11509]: Received disconnect from 180.76.105.81 port 46154:11: Bye Bye [preauth]
May 29 08:49:21 sshd[11509]: Disconnected from invalid user root 180.76.105.81 port 46154 [preauth]
May 29 08:49:28 K2P-USB: Hardware NAT/Routing: Disabled
May 29 08:50:10 sshd[511]: Received signal 15; terminating.

hwj***

可能你那固件有后门？

cix***

国内国际的ip都有啊，哈哈，你是有多吃香

隐形***

网络蚂蚁，网络蜘蛛，网络爬虫，还要去举报，真搞笑。

11267***

改端口不谢

xie***

hwj180 发表于 2020-5-29 09:06
可能你那固件有后门？

固件应该没有问题吧？？？我是在chongshengB大佬的github上下载的。。

xie***

1126732503 发表于 2020-5-29 09:11
改端口不谢

我现在把SSH关了，没有看到日志刷屏了。改端口没有避免吗？下次又被扫出来是不是还是会被爆破。。只能用完SSH关了吗？

jj***

防火墙里 关了 允许外网访问SSH

xie***

jjit 发表于 2020-5-29 09:21
防火墙里 关了 允许外网访问SSH

恩，我不但现在把外网SSH关了，内网的也关了。要用再开。。搞个公网IPV4还真的得做好防护，每次用完关了

foo***

这个一般是自动扫的，如果有漏洞或者密码太弱就遭了

mik***

别把他们想的那么牛B 你改个端口就行了。 22都知道是SSH 你改成别的他怎么知道是SSH 还是远程桌面端口，还是$$端口，还是下载机端口........

xie***

mikeem 发表于 2020-5-29 09:42
别把他们想的那么牛B 你改个端口就行了。 22都知道是SSH 你改成别的他怎么知道是SSH 还是远程桌面端口，还 ...

可以那就这样操作，内网shh也改10000以上。外网3万起步。。哈哈

隐形***

xiexuan 发表于 2020-5-29 10:40
可以那就这样操作，内网shh也改10000以上。外网3万起步。。哈哈

太大了的端口  像移动这种垃圾宽带会当成BT下载流量直接给你怕死或者带宽优先给你做到最低。

mik***

我就一天24小时开着SSH，你把PING 禁掉这点很重要。但我日常还是多用WEB SSH的方式  https://www.lsgb.net.cn:85