Eu encontrei essas seis linhas repetidas vezes, facilmente, centenas de vezes, no arquivo /var/logs/auth.log do meu servidor Ubuntu. Eu não sou admin-sys , então não tenho certeza do que está acontecendo, mas parece que meu servidor está sob ataque.
É isso que está acontecendo? Há algo que eu possa fazer para evitar isso?
Oct 31 10:43:48 HKS sshd[5414]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key
Oct 31 10:43:50 HKS sshd[5414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Oct 31 10:43:52 HKS sshd[5414]: Failed password for root from 221.229.172.110 port 11962 ssh2
Oct 31 10:43:57 HKS sshd[5414]: message repeated 2 times: [ Failed password for root from 221.229.172.110 port 11962 ssh2]
Oct 31 10:43:57 HKS sshd[5414]: Received disconnect from 221.229.172.110: 11: [preauth]
Oct 31 10:43:57 HKS sshd[5414]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Comecei a investigar isso porque o servidor "misteriosamente" foi reiniciado e ainda não sei por quê. É provavelmente relacionado a isso, certo? Tenho certeza de que essa parte do auth.log está relacionada à reinicialização:
Oct 30 19:44:32 HKS sshd[29546]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key
Oct 30 19:44:33 HKS sshd[29546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Oct 30 19:44:36 HKS sshd[29546]: Failed password for root from 221.229.172.110 port 48035 ssh2
Oct 30 19:44:41 HKS sshd[29546]: message repeated 2 times: [ Failed password for root from 221.229.172.110 port 48035 ssh2]
Oct 30 19:44:41 HKS sshd[29546]: Received disconnect from 221.229.172.110: 11: [preauth]
Oct 30 19:44:41 HKS sshd[29546]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Oct 30 20:05:32 HKS systemd-logind[723]: New seat seat0.
Oct 30 20:05:32 HKS systemd-logind[723]: Watching system buttons on /dev/input/event0 (Power Button)
Oct 30 20:05:33 HKS sshd[844]: Server listening on 0.0.0.0 port 22.
Oct 30 20:05:33 HKS sshd[844]: Server listening on :: port 22.
Oct 30 20:05:33 HKS sshd[887]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key
Oct 30 20:05:34 HKS sshd[887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Oct 30 20:05:36 HKS sshd[887]: Failed password for root from 221.229.172.110 port 16680 ssh2
Oct 30 20:05:40 HKS sshd[887]: message repeated 2 times: [ Failed password for root from 221.229.172.110 port 16680 ssh2]
Oct 30 20:05:41 HKS sshd[887]: Received disconnect from 221.229.172.110: 11: [preauth]
Oct 30 20:05:41 HKS sshd[887]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.172.110 user=root
Tags ubuntu