路由器日志文件有大量未知ip，这是被黑客攻击了吗

duwei0331

机器是k3 a1
刷的是梅林固件
无意间看了一下日志文件
大量的下面这个记录
这是被哪个黑客盯上了吗
Sep  9 14:52:59 dropbear[9109]: Exit before auth from <183.82.101.171:34978>: Exited normally

Sep  9 20:13:16 dropbear[31237]: Exit before auth from <46.249.32.60:46996>: (user 'admin', 1 fails): Exited normally

Sep  9 20:25:32 dropbear[7283]: Child connection from 223.233.67.239:17622

Sep  9 22:19:18 dropbear[19526]: Child connection from 87.16.34.45:52800
Sep  9 12:40:09 dropbear[16195]: Login attempt for nonexistent user
Sep  9 12:40:10 dropbear[16195]: Exit before auth from <187.193.81.113:59884>: Exited normally
Sep  9 12:40:10 dropbear[16183]: Exit before auth from <36.94.251.137:65125>: Exited normally


Sep  9 14:41:48 dropbear[1500]: Exit before auth from <175.101.93.162:60748>: Exited normally

Sep  9 22:35:37 dropbear[30593]: Child connection from 45.153.165.33:35424

Sep  9 22:36:46 dropbear[31371]: Exit before auth from <178.220.80.120:55338>: Exited normally
Sep  9 22:36:51 dropbear[31440]: Child connection from 84.176.236.68:39837
Sep  9 22:36:52 dropbear[31452]: Child connection from 141.98.10.250:32950
Sep  9 22:36:52 dropbear[31453]: Child connection from 178.220.80.120:6673


Sep  9 22:55:42 dropbear[12065]: Login attempt for nonexistent user
Sep  9 22:55:43 dropbear[12065]: Exit before auth from <178.220.80.120:1511>: Exited normally
Sep  9 22:55:49 dropbear[12155]: Child connection from 178.220.80.120:61886
Sep  9 22:55:50 dropbear[12155]: Login attempt for nonexistent user
Sep  9 22:55:51 dropbear[12155]: Exit before auth from <178.220.80.120:61886>: Exited normally
Sep  9 22:56:06 dropbear[12339]: Child connection from 178.220.80.120:26255
Sep  9 22:56:07 dropbear[12339]: Login attempt for nonexistent user
Sep  9 22:56:08 dropbear[12339]: Exit before auth from <178.220.80.120:26255>: Exited normally

ntgeralt

如果路由开了ssh，要关闭，或者改端口+强密码

duwei0331

ntgeralt 发表于 2021-9-10 14:55
如果路由开了ssh，要关闭，或者改端口+强密码

谢谢大神
我晚上回家看一下

ikbszj75089

换端口也能扫出来，都是工具自动扫肉鸡了，想安全就关闭或者用key方式登录ssh

duwei0331

ikbszj75089 发表于 2021-9-11 11:42
换端口也能扫出来，都是工具自动扫肉鸡了，想安全就关闭或者用key方式登录ssh

确实是ssh问题，只要关了ssh就没了，我就很好奇要是让他连接上会怎么样