查日志，貌似属报错smbd，谁碰到过同类情况？

thet***

好几天了，每天晚上或者凌晨冒出来在log里面。我又是有强迫症，看到不正常的就不爽。
这段算报错吗》？smbd为什么还有个独立ip去连接？是难道是后门？查过了，118.25.39.83好像是企鹅云。

1. Mar 27 22:27:52 smbd[8365]: [2020/03/27 22:27:52.878709,  0] (read_packet_remainder)
   
2. Mar 27 22:27:52 smbd[8369]: [2020/03/27 22:27:52.879417,  0] (read_packet_remainder)
   
3. Mar 27 22:27:52 smbd[8371]: [2020/03/27 22:27:52.879817,  0] (read_packet_remainder)
   
4. Mar 27 22:27:52 smbd[8375]: [2020/03/27 22:27:52.880153,  0] (read_packet_remainder)
   
5. Mar 27 22:27:52 smbd[8376]: [2020/03/27 22:27:52.880495,  0] (read_packet_remainder)
   
6. Mar 27 22:27:52 smbd[8366]: [2020/03/27 22:27:52.882225,  0] (read_packet_remainder)
   
7. Mar 27 22:27:52 smbd[8368]: [2020/03/27 22:27:52.882673,  0] (read_packet_remainder)
   
8. Mar 27 22:27:52 smbd[8370]: [2020/03/27 22:27:52.883013,  0] (read_packet_remainder)
   
9. Mar 27 22:27:52 smbd[8373]: [2020/03/27 22:27:52.883419,  0] (read_packet_remainder)
   
10. Mar 27 22:27:52 smbd[8374]: [2020/03/27 22:27:52.883804,  0] (read_packet_remainder)
    
11. Mar 27 22:27:52 smbd[8377]: [2020/03/27 22:27:52.884155,  0] (read_packet_remainder)
    
12. Mar 27 22:27:52 smbd[8379]: [2020/03/27 22:27:52.884489,  0] (read_packet_remainder)
    
13. Mar 27 22:27:52 smbd[8380]: [2020/03/27 22:27:52.884822,  0] (read_packet_remainder)
    
14. Mar 27 22:27:52 smbd[8381]: [2020/03/27 22:27:52.886206,  0] (read_packet_remainder)
    
15. Mar 27 22:27:52 smbd[8382]: [2020/03/27 22:27:52.887094,  0] (read_packet_remainder)
    
16. Mar 27 22:27:52 smbd[8367]: [2020/03/27 22:27:52.879308,  0] (read_packet_remainder)
    
17. Mar 27 22:27:52 smbd[8380]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
18. Mar 27 22:27:52 smbd[8379]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
19. Mar 27 22:27:52 smbd[8377]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
20. Mar 27 22:27:52 smbd[8374]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
21. Mar 27 22:27:52 smbd[8373]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
22. Mar 27 22:27:52 smbd[8370]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
23. Mar 27 22:27:52 smbd[8368]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
24. Mar 27 22:27:52 smbd[8366]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
25. Mar 27 22:27:52 smbd[8376]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
26. Mar 27 22:27:52 smbd[8375]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
27. Mar 27 22:27:52 smbd[8371]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
28. Mar 27 22:27:52 smbd[8369]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
29. Mar 27 22:27:52 smbd[8365]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
30. Mar 27 22:27:52 smbd[8381]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
31. Mar 27 22:27:52 smbd[8382]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
32. Mar 27 22:27:52 smbd[8367]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
33. Mar 27 22:27:52 smbd[8372]: [2020/03/27 22:27:52.888713,  0] (read_packet_remainder)
    
34. Mar 27 22:27:52 smbd[8372]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.
    
35. Mar 27 22:27:52 smbd[8383]: [2020/03/27 22:27:52.887326,  0] (read_packet_remainder)
    
36. Mar 27 22:27:52 smbd[8383]:   read_fd_with_timeout failed for client 118.25.39.83 read error = NT code 0xc0000011.

复制代码

thet***

貌似是smb共享文件服务，有访问。

但这时间，这客户端地址，肯定不是我干的。

是谁干的呢？外网118地址，企鹅云。

thet***

有人看看么？

thet***

有人吗？说说吧

thet***

有人吗？说说吧

thet***

1. Apr  4 02:15:39 dropbear[22684]: Child connection from 118.25.154.3:49244
   
2. Apr  4 02:15:39 dropbear[22684]: Login attempt for nonexistent user from 118.25.154.3:49244
   
3. Apr  4 02:15:40 dropbear[22684]: Exit before auth: Exited normally
   
4. Apr  4 02:15:40 dropbear[22685]: Child connection from 118.25.154.3:49260
   
5. Apr  4 02:15:40 dropbear[22685]: Password auth succeeded for 'admin' from 118.25.154.3:49260
   
6. Apr  4 02:18:31 dropbear[22685]: Exit (admin): Exited normally
   
7. Apr  4 02:18:31 dropbear[23329]: Child connection from 118.25.154.3:53577
   
8. Apr  4 02:18:31 dropbear[23329]: Password auth succeeded for 'admin' from 118.25.154.3:53577
   
9. Apr  4 02:21:34 dropbear[23329]: Exit (admin): Exited normally
   
10. Apr  4 02:21:34 dropbear[24024]: Child connection from 118.25.154.3:58660
    
11. Apr  4 02:21:34 dropbear[24024]: Password auth succeeded for 'admin' from 118.25.154.3:58660
    
12. Apr  4 02:24:31 dropbear[24024]: Exit (admin): Exited normally
    
13. Apr  4 02:24:31 dropbear[24668]: Child connection from 118.25.154.3:35046
    
14. Apr  4 02:24:31 dropbear[24668]: Password auth succeeded for 'admin' from 118.25.154.3:35046
    
15. Apr  4 02:27:27 dropbear[24668]: Exit (admin): Exited normally
    
16. Apr  4 02:27:27 dropbear[25341]: Child connection from 118.25.154.3:39752
    
17. Apr  4 02:27:28 dropbear[25341]: Password auth succeeded for 'admin' from 118.25.154.3:39752
    
18. Apr  4 02:30:25 dropbear[25341]: Exit (admin): Exited normally

复制代码

今天凌晨又有日志，好像是外网登录，莫名其妙的，是哪个进程暴露的？padavan固件内置有后门？还是哪个挖矿？

风***

thethrax 发表于 2020-4-4 10:47
今天凌晨又有日志，好像是外网登录，莫名其妙的，是哪个进程暴露的？padavan固件内置有后门？还是哪个挖矿 ...

不懂能不能别瞎说话，还后门都来了。这是有人在硬破解爆破你ssh的密码，因为你的端口开着，公网ip直接扫描就知道你开了哪些端口。

thet***

风萧 发表于 2020-4-4 13:09
不懂能不能别瞎说话，还后门都来了。这是有人在硬破解爆破你ssh的密码，因为你的端口开着，公网ip直接扫 ...

大哥，教下小弟碰到这种情况该怎么做，

风***

thethrax 发表于 2020-4-4 14:35
大哥，教下小弟碰到这种情况该怎么做，

没事别开外网映射端口，尤其是涉及系统安全的，比如什么管理员账号的，路由器账号密码别默认就不改了。尤其是ssh，开ssh就用密钥登陆。

thet***

风萧 发表于 2020-4-6 10:45
没事别开外网映射端口，尤其是涉及系统安全的，比如什么管理员账号的，路由器账号密码别默认就不改了。尤 ...

ssh登录控制台的密码，在padavan里好像就是管理员密码呀，两者是同一组，对吗？
改了管理员密码，就是改了ssh登录控制台密码，对吗?

风***

thethrax 发表于 2020-4-8 08:32
ssh登录控制台的密码，在padavan里好像就是管理员密码呀，两者是同一组，对吗？
改了管理员密码，就是改 ...

是，不止密码一样，账号名也一样，改了管理员账号名，ssh的账号名一样改。