我的 linux 架在固定的 ADSL 網路上 最近查閱 log 檔發現主機 SSH daemon 常被暴力密碼嘗試攻擊 但是奇怪的是"並非"都來自相同的 IP 位址 我查看了一下對方的 IP 有的甚至是韓國網站，我想會是跳板嘛？ 但是奇怪的是，我的固定 ADSL 頻寬非常小，入侵我的主機能有多大作用？ 因為所有的 IP 都不相同，這些遠端主機有可能被植入病毒而不自知嘛？ 我想應該是同一隻暴力登入程式，不過順序有點小差異 如果是利用病毒方式傳播這些暴力登入程式，功能將非常強大 將有可能在短短時間內獲得多數密碼設定簡單的主機主控權 進而成為另一台攻擊跳板 從七月開始，他的攻擊次數都相當短暫 由一開始三次增加為五次 因為 IP 都不相同，一般人很難發現異狀 至於我會發現，是在這次中秋節對方發狂似的嘗試了半小時之多 想必這不只是程式病毒，這機八人在得到特定的資訊後 對特定的主機展開特定的攻擊 以下是記錄檔，這些主機應該都已經被植入這隻程式 請問有人有相同的情形嘛？ Jul 20 14:01:41 daemon sshd[5732]: Illegal user test from 83.103.27.66 Jul 20 14:01:41 daemon sshd[5732]: error: Could not get shadow information for NOUSER Jul 20 14:01:41 daemon sshd[5732]: Failed password for illegal user test from 8 3.103.27.66 port 35396 ssh2 Jul 20 14:01:45 daemon sshd[5734]: Illegal user guest from 83.103.27.66 Jul 20 14:01:45 daemon sshd[5734]: error: Could not get shadow information for NOUSER Jul 20 14:01:45 daemon sshd[5734]: Failed password for illegal user guest from 83.103.27.66 port 35434 ssh2 Jul 20 21:06:40 daemon sshd[5736]: Illegal user test from 131.234.157.10 Jul 20 21:06:40 daemon sshd[5736]: error: Could not get shadow information for NOUSER Jul 20 21:06:40 daemon sshd[5736]: Failed password for illegal user test from 1 31.234.157.10 port 48337 ssh2 Jul 20 21:06:45 daemon sshd[5738]: Illegal user guest from 131.234.157.10 Jul 20 21:06:45 daemon sshd[5738]: error: Could not get shadow information for NOUSER Jul 20 21:06:45 daemon sshd[5738]: Failed password for illegal user guest from 131.234.157.10 port 48433 ssh2 Jul 20 21:06:50 daemon sshd[5740]: Illegal user admin from 131.234.157.10 Jul 20 21:06:50 daemon sshd[5740]: error: Could not get shadow information for NOUSER Jul 20 21:06:50 daemon sshd[5740]: Failed password for illegal user admin from 131.234.157.10 port 48538 ssh2 Jul 20 21:06:55 daemon sshd[5742]: Illegal user admin from 131.234.157.10 Jul 20 21:06:55 daemon sshd[5742]: error: Could not get shadow information for NOUSER Jul 20 21:06:55 daemon sshd[5742]: Failed password for illegal user admin from 131.234.157.10 port 48623 ssh2 Jul 20 21:07:00 daemon sshd[5744]: Illegal user user from 131.234.157.10 Jul 20 21:07:00 daemon sshd[5744]: error: Could not get shadow information for NOUSER Jul 20 21:07:00 daemon sshd[5744]: Failed password for illegal user user from 1 31.234.157.10 port 48719 ssh2 Jul 20 21:07:00 daemon sshd[5744]: error: Could not get shadow information for NOUSER Jul 20 21:07:00 daemon sshd[5744]: Failed password for illegal user user from 1 31.234.157.10 port 48719 ssh2 Jul 20 21:07:05 daemon sshd[5746]: Failed password for root from 131.234.157.10 port 48818 ssh2 Jul 20 21:07:09 daemon sshd[5748]: Failed password for root from 131.234.157.10 port 48918 ssh2 Jul 20 21:07:13 daemon sshd[5750]: Failed password for root from 131.234.157.10 port 49003 ssh2 Jul 20 21:07:17 daemon sshd[5752]: Illegal user test from 131.234.157.10 Jul 20 21:07:17 daemon sshd[5752]: error: Could not get shadow information for NOUSER Jul 20 21:07:17 daemon sshd[5752]: Failed password for illegal user test from 1 31.234.157.10 port 49092 ssh2 Jul 24 04:27:27 daemon sshd[5834]: Failed password for root from 130.251.7.2 po rt 59483 ssh2 Jul 27 12:56:16 daemon sshd[5871]: Failed password for root from 66.63.160.36 p ort 38887 ssh2 Jul 27 12:56:16 daemon sshd[5872]: warning: /etc/hosts.allow, line 6: can't ver ify hostname: gethostbyname(36.oc3networks.co\ m) failed 全部都會先以以上所示測試這些帳號，以下紀錄為攻擊的點 Aug 5 08:18:54 daemon sshd[6019]: Failed password for root from 163.32.151.3 p ort 40388 ssh2 Aug 7 15:55:51 daemon sshd[6094]: Failed password for root from 210.205.6.157 port 57248 ssh2 Aug 7 20:59:53 daemon sshd[6112]: Failed password for root from 218.15.207.40 port 54459 ssh2 Aug 7 22:18:23 daemon sshd[6130]: Failed password for root from 134.208.10.158 port 52941 ssh2 Aug 10 10:46:31 daemon sshd[6178]: Failed password for root from 202.78.172.20 port 2285 ssh2 Aug 11 02:20:20 daemon sshd[6206]: Failed password for root from 202.102.242.17 8 port 42193 ssh2 Aug 12 00:56:10 daemon sshd[6241]: Failed password for root from 210.204.129.11 port 46918 ssh2 Aug 12 10:40:26 daemon sshd[6259]: Failed password for root from 210.95.186.129 port 55288 ssh2 Aug 12 18:47:41 daemon sshd[6281]: Failed password for root from 61.40.11.45 po rt 37766 ssh2 Aug 12 18:48:37 daemon sshd[6299]: Failed password for root from 61.40.11.45 po rt 40366 ssh2 Aug 14 09:06:57 daemon sshd[6331]: Failed password for root from 212.152.171.10 2 port 49563 ssh2 Aug 15 06:21:43 daemon sshd[6471]: Failed password for root from 202.100.222.12 3 port 35632 ssh2 Aug 15 11:53:47 daemon sshd[6489]: Failed password for root from 212.71.131.226 port 4197 ssh2 Aug 15 11:54:16 daemon sshd[6503]: Failed password for root from 212.71.131.226 port 4904 ssh2 Aug 15 11:56:35 daemon sshd[6571]: Failed password for root from 212.71.131.226 port 4332 ssh2 11:54 為開始攻擊時間，11:56為結束攻擊時間，連續 Aug 18 04:10:46 daemon sshd[6730]: Failed password for root from 203.196.231.2 port 54084 ssh2 Aug 20 13:51:02 daemon sshd[6802]: Failed password for root from 222.38.28.107 port 41406 ssh2 Aug 21 19:30:00 daemon sshd[6838]: Failed password for root from 220.70.7.225 p ort 47204 ssh2 Aug 23 12:56:16 daemon sshd[6888]: Failed password for root from 80.204.43.237 port 55792 ssh2 Aug 27 12:28:54 daemon sshd[551]: Failed password for root from 163.25.65.3 por t 40217 ssh2 Aug 28 01:26:06 daemon sshd[590]: Failed password for root from 220.130.156.130 port 1395 ssh2 Aug 28 04:32:03 daemon sshd[608]: Failed password for root from 221.166.169.102 port 39723 ssh2 Aug 28 12:16:09 daemon sshd[626]: Failed password for root from 61.150.43.123 p ort 47214 ssh2 Aug 30 19:20:15 daemon sshd[646]: Failed password for root from 140.128.102.115 port 1830 ssh2 Sep 1 10:23:12 daemon sshd[796]: Failed password for root from 61.36.184.166 p ort 39995 ssh2 Sep 1 10:38:36 daemon sshd[814]: Failed password for root from 221.3.131.80 po rt 34775 ssh2 Sep 2 22:46:05 daemon sshd[840]: Failed password for root from 220.64.223.183 port 49850 ssh2 Sep 4 22:43:11 daemon sshd[879]: Failed password for root from 218.235.97.206 port 35705 ssh2 Sep 5 04:12:47 daemon sshd[897]: Failed password for root from 62.50.74.178 po rt 51847 ssh2 Sep 5 09:00:37 daemon sshd[929]: Failed password for root from 61.129.45.97 po rt 35165 ssh2 Sep 5 09:10:29 daemon sshd[1397]: Failed password for root from 61.129.45.97 p ort 51084 ssh2 09:00 為開始攻擊時間，09:10為結束攻擊時間，連續 Sep 6 07:45:46 daemon sshd[1412]: Failed password for root from 61.38.92.160 p ort 51669 ssh2 Sep 7 23:38:08 daemon sshd[1432]: Failed password for root from 221.166.169.10 2 port 35369 ssh2 Sep 8 19:55:42 daemon sshd[1495]: Failed password for root from 221.207.59.129 port 58874 ssh2 Sep 12 03:00:11 daemon sshd[1534]: Failed password for root from 211.248.173.2 port 3195 ssh2 Sep 13 07:56:28 daemon sshd[1574]: Failed password for root from 218.84.126.17 port 41568 ssh2 Sep 13 09:27:02 daemon sshd[1592]: Failed password for root from 210.76.125.14 port 51846 ssh2 Sep 16 02:24:35 daemon sshd[1611]: Failed password for root from 195.16.96.218 port 56303 ssh2 Sep 16 02:31:38 daemon sshd[1815]: Failed password for root from 195.16.96.218 port 34595 ssh2 02:24 為開始攻擊時間，02:31為結束攻擊時間，連續 Sep 17 17:20:59 daemon sshd[1834]: Failed password for root from 219.153.4.62 p ort 54853 ssh2 Sep 17 17:24:20 daemon sshd[1966]: Failed password for root from 219.153.4.62 p ort 59549 ssh2 17:20 為開始攻擊時間，17:24為結束攻擊時間，連續 Sep 23 01:12:43 daemon sshd[1985]: Failed password for root from 218.6.145.91 p ort 51763 ssh2 Sep 25 06:40:34 daemon sshd[2009]: Failed password for root from 202.90.159.243 port 59794 ssh2 Sep 26 06:23:04 daemon sshd[2027]: Failed password for root from 221.5.251.160 port 36665 ssh2 Sep 28 14:50:20 daemon sshd[2047]: Failed password for root from 210.205.6.157 port 52187 ssh2 Sep 28 15:21:17 daemon sshd[3397]: Failed password for root from 210.205.6.157 port 55668 ssh2 14:50 為開始攻擊時間，15:21為結束攻擊時間，連續 這次才發現異狀，攻擊最久 --

※ 發信站: 批踢踢實業坊(ptt.cc) ◆ From: 218.34.129.2