我的箱子被攻击了

Question

现在，我登录到我的数字海洋的盒子，我可以清楚地看到这个在我的日志中，我想是某种脚本试图闯入：

Mar  8 13:25:25 sshd[11311]: Invalid user schedule from 216.157.31.144
Mar  8 13:25:25 sshd[11311]: input_userauth_request: invalid user schedule [preauth]
Mar  8 13:25:25 sshd[11311]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:25:25 sshd[11311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144 
Mar  8 13:25:27 sshd[11311]: Failed password for invalid user schedule from 216.157.31.144 port 32774 ssh2
Mar  8 13:25:27 sshd[11311]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar  8 13:26:26 sshd[11313]: reverse mapping checking getaddrinfo for new.mega.nn.ru [93.183.127.194] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar  8 13:26:26 sshd[11313]: Invalid user toor from 93.183.127.194
Mar  8 13:26:26 sshd[11313]: input_userauth_request: invalid user toor [preauth]
Mar  8 13:26:26 sshd[11313]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:26:26 sshd[11313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.183.127.194 
Mar  8 13:26:28 sshd[11313]: Failed password for invalid user toor from 93.183.127.194 port 48789 ssh2
Mar  8 13:26:28 sshd[11313]: Received disconnect from 93.183.127.194: 11: Bye Bye [preauth]
Mar  8 13:28:08 sshd[11315]: Invalid user administrator from 24.24.96.163
Mar  8 13:28:08 sshd[11315]: input_userauth_request: invalid user administrator [preauth]
Mar  8 13:28:08 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:08 sshd[11315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163 
Mar  8 13:28:09 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:10 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:12 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:12 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:14 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:14 sshd[11315]: Connection closed by 24.24.96.163 [preauth]
Mar  8 13:28:14 sshd[11315]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163 
Mar  8 13:28:18 sshd[11317]: Did not receive identification string from 80.78.102.189
Mar  8 13:28:19 sshd[11318]: reverse mapping checking getaddrinfo for zbmo-ll.umn.ru [80.78.102.189] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar  8 13:28:19 sshd[11318]: Invalid user admin from 80.78.102.189
Mar  8 13:28:19 sshd[11318]: input_userauth_request: invalid user admin [preauth]
Mar  8 13:28:19 sshd[11318]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:19 sshd[11318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.102.189 
Mar  8 13:28:21 sshd[11318]: Failed password for invalid user admin from 80.78.102.189 port 50953 ssh2
Mar  8 13:28:21 sshd[11318]: Connection closed by 80.78.102.189 [preauth]
Mar  8 13:31:03 sshd[11331]: Invalid user schiko from 216.157.31.144
Mar  8 13:31:03 sshd[11331]: input_userauth_request: invalid user schiko [preauth]
Mar  8 13:31:03 sshd[11331]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:31:03 sshd[11331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144 
Mar  8 13:31:04 sshd[11331]: Failed password for invalid user schiko from 216.157.31.144 port 20222 ssh2
Mar  8 13:31:04 sshd[11331]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar  8 13:31:48 sshd[11333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:31:50 sshd[11333]: Failed password for root from 125.88.177.90 port 27353 ssh2
Mar  8 13:31:55  sshd[11333]: last message repeated 2 times
Mar  8 13:31:55 sshd[11333]: Received disconnect from 125.88.177.90: 11:  [preauth]
Mar  8 13:31:55 sshd[11333]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:31:58 sshd[11335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:00 sshd[11335]: Failed password for root from 125.88.177.90 port 57212 ssh2
Mar  8 13:32:05  sshd[11335]: last message repeated 2 times
Mar  8 13:32:05 sshd[11335]: Received disconnect from 125.88.177.90: 11:  [preauth]
Mar  8 13:32:05 sshd[11335]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:08 sshd[11337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:10 sshd[11337]: Failed password for root from 125.88.177.90 port 35022 ssh2
Mar  8 13:32:15  sshd[11337]: last message repeated 2 times
Mar  8 13:32:15 sshd[11337]: Received disconnect from 125.88.177.90: 11:  [preauth]

我看到多个IP正在试图访问它以进入！

在做lsof -i | less之后

我在输出结束的某个地方看到了这一点，我猜这个125-ip是否在其中？

sshd     11548     root    3r  IPv4 5046701      0t0  TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
sshd     11549     sshd    3u  IPv4 5046701      0t0  TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)

我使用私钥作为无密码ssh loggin访问液滴，但我知道，如果密码被猜测，根用户仍然可以登录，对吗？

Answer 1

您没有提供任何关于您的sshd_config的信息，但是最好的起点是使用公开密钥身份验证，即完全拒绝密码身份验证和拒绝根登录：

PermitRootLogin no  # or  without-password  if you need that login
PasswordAuthentication no
ChallengeResponseAuthentication no

如果不允许密码身份验证，您将消除几乎所有的攻击。对公钥认证进行攻击是不可行的。