Włam?

[Gość sabby7890]

Witam,

 

Ostatnio przeglądałem sobie plik /var/log/secure i widzę tam mnóstwo prób zalogowania się na mojego kompa. Oto malutka część:

 

Oct 19 01:46:34 localhost sshd[18534]: Did not receive identification string from 211.24.162.84
Oct 19 05:45:32 localhost sshd[19128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:45:34 localhost sshd[19128]: Failed password for root from 211.24.162.84 port 40983 ssh2
Oct 19 05:45:34 localhost sshd[19129]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:45:38 localhost sshd[19131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:45:39 localhost sshd[19131]: Failed password for root from 211.24.162.84 port 41057 ssh2
Oct 19 05:45:40 localhost sshd[19132]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:45:44 localhost sshd[19136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:45:47 localhost sshd[19136]: Failed password for root from 211.24.162.84 port 41122 ssh2
Oct 19 05:45:47 localhost sshd[19137]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:45:51 localhost sshd[19139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:45:53 localhost sshd[19139]: Failed password for root from 211.24.162.84 port 41188 ssh2
Oct 19 05:45:53 localhost sshd[19140]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:45:56 localhost sshd[19141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:45:59 localhost sshd[19141]: Failed password for root from 211.24.162.84 port 41261 ssh2
Oct 19 05:45:59 localhost sshd[19142]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:03 localhost sshd[19143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:05 localhost sshd[19143]: Failed password for root from 211.24.162.84 port 41333 ssh2
Oct 19 05:46:06 localhost sshd[19144]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:09 localhost sshd[19145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:11 localhost sshd[19145]: Failed password for root from 211.24.162.84 port 41404 ssh2
Oct 19 05:46:12 localhost sshd[19146]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:15 localhost sshd[19148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:17 localhost sshd[19148]: Failed password for root from 211.24.162.84 port 41469 ssh2
Oct 19 05:46:17 localhost sshd[19149]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:20 localhost sshd[19150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:22 localhost sshd[19150]: Failed password for root from 211.24.162.84 port 41542 ssh2
Oct 19 05:46:23 localhost sshd[19151]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:27 localhost sshd[19152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:28 localhost sshd[19152]: Failed password for root from 211.24.162.84 port 41608 ssh2
Oct 19 05:46:29 localhost sshd[19153]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:32 localhost sshd[19154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:34 localhost sshd[19154]: Failed password for root from 211.24.162.84 port 41674 ssh2
Oct 19 05:46:34 localhost sshd[19155]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:39 localhost sshd[19156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:41 localhost sshd[19156]: Failed password for root from 211.24.162.84 port 41740 ssh2
Oct 19 05:46:41 localhost sshd[19157]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:46 localhost sshd[19158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:48 localhost sshd[19158]: Failed password for root from 211.24.162.84 port 41803 ssh2
Oct 19 05:46:49 localhost sshd[19159]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:46:53 localhost sshd[19160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:46:56 localhost sshd[19160]: Failed password for root from 211.24.162.84 port 41863 ssh2
Oct 19 05:46:57 localhost sshd[19161]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:01 localhost sshd[19162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:03 localhost sshd[19162]: Failed password for root from 211.24.162.84 port 41933 ssh2
Oct 19 05:47:03 localhost sshd[19163]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:07 localhost sshd[19165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:09 localhost sshd[19165]: Failed password for root from 211.24.162.84 port 42004 ssh2
Oct 19 05:47:09 localhost sshd[19166]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:13 localhost sshd[19167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:15 localhost sshd[19167]: Failed password for root from 211.24.162.84 port 42071 ssh2
Oct 19 05:47:16 localhost sshd[19168]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:23 localhost sshd[19169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:25 localhost sshd[19169]: Failed password for root from 211.24.162.84 port 42141 ssh2
Oct 19 05:47:26 localhost sshd[19170]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:33 localhost sshd[19172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:34 localhost sshd[19172]: Failed password for root from 211.24.162.84 port 42201 ssh2
Oct 19 05:47:35 localhost sshd[19173]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:42 localhost sshd[19174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:44 localhost sshd[19174]: Failed password for root from 211.24.162.84 port 42259 ssh2
Oct 19 05:47:45 localhost sshd[19175]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:47:51 localhost sshd[19176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:47:54 localhost sshd[19176]: Failed password for root from 211.24.162.84 port 42325 ssh2
Oct 19 05:47:55 localhost sshd[19177]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:01 localhost sshd[19178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:03 localhost sshd[19178]: Failed password for root from 211.24.162.84 port 42387 ssh2
Oct 19 05:48:04 localhost sshd[19179]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:09 localhost sshd[19180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:11 localhost sshd[19180]: Failed password for root from 211.24.162.84 port 42453 ssh2
Oct 19 05:48:11 localhost sshd[19181]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:15 localhost sshd[19182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:17 localhost sshd[19182]: Failed password for root from 211.24.162.84 port 42520 ssh2
Oct 19 05:48:18 localhost sshd[19183]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:22 localhost sshd[19185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:24 localhost sshd[19185]: Failed password for root from 211.24.162.84 port 42585 ssh2
Oct 19 05:48:25 localhost sshd[19186]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:30 localhost sshd[19187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:32 localhost sshd[19187]: Failed password for root from 211.24.162.84 port 42648 ssh2
Oct 19 05:48:32 localhost sshd[19188]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:36 localhost sshd[19189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:38 localhost sshd[19189]: Failed password for root from 211.24.162.84 port 42707 ssh2
Oct 19 05:48:39 localhost sshd[19190]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:43 localhost sshd[19192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:45 localhost sshd[19192]: Failed password for root from 211.24.162.84 port 42774 ssh2
Oct 19 05:48:46 localhost sshd[19193]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:51 localhost sshd[19194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:48:53 localhost sshd[19194]: Failed password for root from 211.24.162.84 port 42830 ssh2
Oct 19 05:48:53 localhost sshd[19195]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:48:59 localhost sshd[19196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:02 localhost sshd[19196]: Failed password for root from 211.24.162.84 port 42891 ssh2
Oct 19 05:49:03 localhost sshd[19197]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:08 localhost sshd[19198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:09 localhost sshd[19198]: Failed password for root from 211.24.162.84 port 42958 ssh2
Oct 19 05:49:10 localhost sshd[19199]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:15 localhost sshd[19200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:17 localhost sshd[19200]: Failed password for root from 211.24.162.84 port 43018 ssh2
Oct 19 05:49:18 localhost sshd[19201]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:23 localhost sshd[19202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:26 localhost sshd[19202]: Failed password for root from 211.24.162.84 port 43078 ssh2
Oct 19 05:49:27 localhost sshd[19203]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:32 localhost sshd[19204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:34 localhost sshd[19204]: Failed password for root from 211.24.162.84 port 43148 ssh2
Oct 19 05:49:35 localhost sshd[19205]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:41 localhost sshd[19207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:43 localhost sshd[19207]: Failed password for root from 211.24.162.84 port 43207 ssh2
Oct 19 05:49:43 localhost sshd[19208]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:49 localhost sshd[19209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:49:51 localhost sshd[19209]: Failed password for root from 211.24.162.84 port 43265 ssh2
Oct 19 05:49:52 localhost sshd[19210]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:49:58 localhost sshd[19211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:00 localhost sshd[19211]: Failed password for root from 211.24.162.84 port 43328 ssh2
Oct 19 05:50:01 localhost sshd[19213]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:08 localhost sshd[19214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:10 localhost sshd[19214]: Failed password for root from 211.24.162.84 port 43397 ssh2
Oct 19 05:50:10 localhost sshd[19215]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:16 localhost sshd[19216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:18 localhost sshd[19216]: Failed password for root from 211.24.162.84 port 43458 ssh2
Oct 19 05:50:19 localhost sshd[19217]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:25 localhost sshd[19218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:26 localhost sshd[19218]: Failed password for root from 211.24.162.84 port 43523 ssh2
Oct 19 05:50:27 localhost sshd[19219]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:34 localhost sshd[19220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:36 localhost sshd[19220]: Failed password for root from 211.24.162.84 port 43586 ssh2
Oct 19 05:50:37 localhost sshd[19221]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:43 localhost sshd[19226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:45 localhost sshd[19226]: Failed password for root from 211.24.162.84 port 43650 ssh2
Oct 19 05:50:46 localhost sshd[19227]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:52 localhost sshd[19229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:50:54 localhost sshd[19229]: Failed password for root from 211.24.162.84 port 43705 ssh2
Oct 19 05:50:54 localhost sshd[19230]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:50:59 localhost sshd[19231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:51:01 localhost sshd[19231]: Failed password for root from 211.24.162.84 port 43768 ssh2
Oct 19 05:51:02 localhost sshd[19232]: Received disconnect from 211.24.162.84: 11: Bye Bye
Oct 19 05:51:08 localhost sshd[19233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.162.84  user=root
Oct 19 05:51:09 localhost sshd[19233]: Failed password for root from 211.24.162.84 port 43828 ssh2

 

Czy to jest jakiś standardowy komunikat, czy ktoś mi chce wejść na kompa?

 

SSH jest mi potrzebny, loguję się na kompa z pracy przy pomocy PuTTY

 

Jest jeszcze parę komunikatów typu POSSIBLE BREAK-IN ATTEMPT! itp, nie wiem co się dzieje

 

Pozdrawiam

[roger_sanchez87]

Nic nowego Często się zdarzają ataki słownikowe na komputery z SSH podstawionym na domyślnym porcie. Proponowałbym zmienić port dla usługi i zobaczyć czy próby włamania będą nadal występować.

[ecik__]

To wygląda jak jakiś automat, który usiłuje poszukać słabych ssh. Możesz w firewallu zablokować tamten IP, albo zmienić port, na którym masz ssh.

[Gość sabby7890]

Dzięki za odpowiedzi:) Właśnie mam takie wrażenie, że to automat, hasło mam dość niesłownikowe (zlepek kodów na powerupy i coś tam jeszcze z jednej z gierek:P), ale i tak lepiej się spytać Dzięki!

[matlas]

najlepiej wytnij to ip na iptables:) albo zrob mu przekierowanie sam do siebie