openwrt被攻击怎么办？？大佬帮帮我

qq826***

大佬们。被攻击这么改端口？nano /etc/ssh/sshd_config
找到port22，移动光标将22可以改为32等等数值。
改完后ctrl+x保存     这个没用呀

qq826***

[img][/img]

qq826***

大佬们，被攻击咋办？小白求教nano /etc/ssh/sshd_config
找到port22，移动光标将22可以改为32等等数值。
改完后ctrl+x保存   这个方法没用啊，还是改不了端口，求大佬帮忙








Fri May 28 17:20:32 2021 auth.info sshd[23022]: Connection closed by invalid user telecomadmin 202.179.24.242 port 56543 [preauth]
Fri May 28 17:20:39 2021 auth.info sshd[23157]: Invalid user telecomadmin from 202.179.24.242 port 57390
Fri May 28 17:20:39 2021 auth.err sshd[23157]: error: Could not get shadow information for NOUSER
Fri May 28 17:20:39 2021 auth.info sshd[23157]: Failed password for invalid user telecomadmin from 202.179.24.242 port 57390 ssh2
Fri May 28 17:20:39 2021 auth.info sshd[23157]: Connection closed by invalid user telecomadmin 202.179.24.242 port 57390 [preauth]
Fri May 28 17:20:46 2021 auth.info sshd[23246]: Invalid user telecomadmin from 202.179.24.242 port 58228
Fri May 28 17:20:47 2021 auth.err sshd[23246]: error: Could not get shadow information for NOUSER
Fri May 28 17:20:47 2021 auth.info sshd[23246]: Failed password for invalid user telecomadmin from 202.179.24.242 port 58228 ssh2
Fri May 28 17:20:47 2021 auth.info sshd[23246]: Connection closed by invalid user telecomadmin 202.179.24.242 port 58228 [preauth]
Fri May 28 17:20:55 2021 auth.info sshd[23373]: Invalid user telecomadmin from 202.179.24.242 port 59027
Fri May 28 17:20:55 2021 auth.err sshd[23373]: error: Could not get shadow information for NOUSER
Fri May 28 17:20:55 2021 auth.info sshd[23373]: Failed password for invalid user telecomadmin from 202.179.24.242 port 59027 ssh2
Fri May 28 17:20:56 2021 auth.info sshd[23373]: Connection closed by invalid user telecomadmin 202.179.24.242 port 59027 [preauth]
Fri May 28 17:21:05 2021 auth.info sshd[23516]: Invalid user telecomadmin from 202.179.24.242 port 59893
Fri May 28 17:21:05 2021 auth.err sshd[23516]: error: Could not get shadow information for NOUSER
Fri May 28 17:21:05 2021 auth.info sshd[23516]: Failed password for invalid user telecomadmin from 202.179.24.242 port 59893 ssh2
Fri May 28 17:21:05 2021 auth.info sshd[23516]: Connection closed by invalid user telecomadmin 202.179.24.242 port 59893 [preauth]
Fri May 28 17:39:31 2021 auth.info sshd[3215]: Connection reset by 177.79.67.153 port 40793 [preauth]
Fri May 28 17:46:05 2021 auth.err sshd[8378]: error: kex_exchange_identification: Connection closed by remote host
Fri May 28 17:46:05 2021 auth.info sshd[8378]: Connection closed by 167.71.0.205 port 50298
Fri May 28 17:47:33 2021 auth.err sshd[9231]: error: kex_exchange_identification: Connection closed by remote host
Fri May 28 17:47:33 2021 auth.info sshd[9231]: Connection closed by 195.133.40.214 port 46546
Fri May 28 17:52:09 2021 auth.info sshd[12333]: Invalid user user from 167.71.0.205 port 41130
Fri May 28 17:52:09 2021 auth.err sshd[12333]: error: Could not get shadow information for NOUSER
Fri May 28 17:52:09 2021 auth.info sshd[12333]: Failed password for invalid user user from 167.71.0.205 port 41130 ssh2
Fri May 28 17:52:10 2021 auth.info sshd[12333]: Received disconnect from 167.71.0.205 port 41130:11: Normal Shutdown, Thank you for playing [preauth]
Fri May 28 17:52:10 2021 auth.info sshd[12333]: Disconnected from invalid user user 167.71.0.205 port 41130 [preauth]
Fri May 28 17:53:03 2021 auth.info sshd[12921]: Invalid user user from 195.133.40.214 port 41730
Fri May 28 17:53:03 2021 auth.err sshd[12921]: error: Could not get shadow information for NOUSER
Fri May 28 17:53:03 2021 auth.info sshd[12921]: Failed password for invalid user user from 195.133.40.214 port 41730 ssh2
Fri May 28 17:53:03 2021 auth.info sshd[12921]: Received disconnect from 195.133.40.214 port 41730:11: Normal Shutdown, Thank you for playing [preauth]
Fri May 28 17:53:03 2021 auth.info sshd[12921]: Disconnected from invalid user user 195.133.40.214 port 41730 [preauth]
Fri May 28 17:57:53 2021 auth.info sshd[16339]: Invalid user user from 195.133.40.214 port 60808
Fri May 28 17:57:53 2021 auth.err sshd[16339]: error: Could not get shadow information for NOUSER
Fri May 28 17:57:53 2021 auth.info sshd[16339]: Failed password for invalid user user from 195.133.40.214 port 60808 ssh2
Fri May 28 17:57:53 2021 auth.info sshd[16339]: Received disconnect from 195.133.40.214 port 60808:11: Normal Shutdown, Thank you for playing [preauth]
Fri May 28 17:57:53 2021 auth.info sshd[16339]: Disconnected from invalid user user 195.133.40.214 port 60808 [preauth]

yuy***

关闭密码登录 改密钥登录 公网ssh端口换成个非常见端口

qq826***

yuyuyg 发表于 2021-5-28 18:21
关闭密码登录 改密钥登录 公网ssh端口换成个非常见端口

大佬，我不会啊，怎么换？f大直接设置不了啊

yuy***

qq826841073 发表于 2021-5-28 18:23
大佬，我不会啊，怎么换？f大直接设置不了啊

你不会还那用什么？指望别人喂到嘴里吗？

jj***

网页，系统，管理权里
接口 设置为 lan，端口 改成冷门的端口号，重启

迷路的***

改一下doropbear的设置就完了。
config dropbear
        option Port '15471'
        option Interface 'lan'
        option PasswordAuth 'off'
        option RootPasswordAuth 'off'

qq826***

yuyuyg 发表于 2021-5-28 18:33
你不会还那用什么？指望别人喂到嘴里吗？

就是百度了，找不到怎么设置

qq826***

jjit 发表于 2021-5-28 18:34
网页，系统，管理权里
接口 设置为 lan，端口 改成冷门的端口号，重启

F大的固件没有，设置，

qq826***

迷路的羽先生 发表于 2021-5-28 18:38
改一下doropbear的设置就完了。
config dropbear
        option Port '15471'

大佬，是这样改端口吗？

迷路的***

qq826841073 发表于 2021-5-28 18:40
大佬，是这样改端口吗？

首先你的固件应该编译了dropbear
如果编译了的话，你可以直接去系统-管理权里面就能看到一个ssh访问的选项
在里面的dropbear实例里把端口改成其他值
然后取消勾选下面三个选项密码验证，允许root用户凭密码登录，网关端口
反正你大概率也不会用到ssh……

小小***

你N1用的什么模式？旁路由还是主路由？

翡冷***

拔网线，这个应该可以解决问题

隐形***

很明显你的ssh端口就没改