agora estou logado na caixa do meu digitalocean e posso ver claramente isso no meu log e eu acho que alguma espécie de script está tentando invadir:
Mar 8 13:25:25 sshd[11311]: Invalid user schedule from 216.157.31.144
Mar 8 13:25:25 sshd[11311]: input_userauth_request: invalid user schedule [preauth]
Mar 8 13:25:25 sshd[11311]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:25:25 sshd[11311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144
Mar 8 13:25:27 sshd[11311]: Failed password for invalid user schedule from 216.157.31.144 port 32774 ssh2
Mar 8 13:25:27 sshd[11311]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar 8 13:26:26 sshd[11313]: reverse mapping checking getaddrinfo for new.mega.nn.ru [93.183.127.194] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 8 13:26:26 sshd[11313]: Invalid user toor from 93.183.127.194
Mar 8 13:26:26 sshd[11313]: input_userauth_request: invalid user toor [preauth]
Mar 8 13:26:26 sshd[11313]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:26:26 sshd[11313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.183.127.194
Mar 8 13:26:28 sshd[11313]: Failed password for invalid user toor from 93.183.127.194 port 48789 ssh2
Mar 8 13:26:28 sshd[11313]: Received disconnect from 93.183.127.194: 11: Bye Bye [preauth]
Mar 8 13:28:08 sshd[11315]: Invalid user administrator from 24.24.96.163
Mar 8 13:28:08 sshd[11315]: input_userauth_request: invalid user administrator [preauth]
Mar 8 13:28:08 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:08 sshd[11315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163
Mar 8 13:28:09 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:10 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:12 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:12 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:14 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:14 sshd[11315]: Connection closed by 24.24.96.163 [preauth]
Mar 8 13:28:14 sshd[11315]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163
Mar 8 13:28:18 sshd[11317]: Did not receive identification string from 80.78.102.189
Mar 8 13:28:19 sshd[11318]: reverse mapping checking getaddrinfo for zbmo-ll.umn.ru [80.78.102.189] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 8 13:28:19 sshd[11318]: Invalid user admin from 80.78.102.189
Mar 8 13:28:19 sshd[11318]: input_userauth_request: invalid user admin [preauth]
Mar 8 13:28:19 sshd[11318]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:19 sshd[11318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.102.189
Mar 8 13:28:21 sshd[11318]: Failed password for invalid user admin from 80.78.102.189 port 50953 ssh2
Mar 8 13:28:21 sshd[11318]: Connection closed by 80.78.102.189 [preauth]
Mar 8 13:31:03 sshd[11331]: Invalid user schiko from 216.157.31.144
Mar 8 13:31:03 sshd[11331]: input_userauth_request: invalid user schiko [preauth]
Mar 8 13:31:03 sshd[11331]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:31:03 sshd[11331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144
Mar 8 13:31:04 sshd[11331]: Failed password for invalid user schiko from 216.157.31.144 port 20222 ssh2
Mar 8 13:31:04 sshd[11331]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar 8 13:31:48 sshd[11333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:31:50 sshd[11333]: Failed password for root from 125.88.177.90 port 27353 ssh2
Mar 8 13:31:55 sshd[11333]: last message repeated 2 times
Mar 8 13:31:55 sshd[11333]: Received disconnect from 125.88.177.90: 11: [preauth]
Mar 8 13:31:55 sshd[11333]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:31:58 sshd[11335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:00 sshd[11335]: Failed password for root from 125.88.177.90 port 57212 ssh2
Mar 8 13:32:05 sshd[11335]: last message repeated 2 times
Mar 8 13:32:05 sshd[11335]: Received disconnect from 125.88.177.90: 11: [preauth]
Mar 8 13:32:05 sshd[11335]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:08 sshd[11337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:10 sshd[11337]: Failed password for root from 125.88.177.90 port 35022 ssh2
Mar 8 13:32:15 sshd[11337]: last message repeated 2 times
Mar 8 13:32:15 sshd[11337]: Received disconnect from 125.88.177.90: 11: [preauth]
Eu vejo que vários IPs estão tentando acessá-lo para entrar!
Depois de fazer lsof -i | less
Eu vejo isso em algum lugar no final da saída, e eu acho certo que este 125-ip está dentro ou não?
sshd 11548 root 3r IPv4 5046701 0t0 TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
sshd 11549 sshd 3u IPv4 5046701 0t0 TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
Estou acessando o droplet com minha chave privada como ssh loggin sem senha, mas como eu sei, o usuário root ainda pode fazer o login se a senha for adivinhada, certo?
Você não forneceu nenhuma informação sobre seu sshd_config , mas um bom lugar para começar, você está usando a autenticação de chave pública para negar a autenticação de senha e negar o login de raiz:
PermitRootLogin no # or without-password if you need that login
PasswordAuthentication no
ChallengeResponseAuthentication no
Se a autenticação por senha não for permitida, você se livrará de quase todos os ataques. Não é possível atacar a autenticação de chave pública.
Tags ssh