可疑网络活动: sshd过程中出现lsof

Question

我有个叫Raspberry的人在运行Debian Jessie。我安装了π孔来阻止广告服务域(https://pi-hole.net).通过查看日志，我注意到很多来自中国域的查询。

lsof -i向我展示了我认为值得怀疑的以下列表：

> sshd      1742             root    3u  IPv4  16960      0t0  TCP
> raspberrypi:ssh->116.31.116.47:50600 (ESTABLISHED) sshd      1743     
> sshd    3u  IPv4  16960      0t0  TCP
> raspberrypi:ssh->116.31.116.47:50600 (ESTABLISHED) sshd      1774     
> root    3u  IPv4  16990      0t0  TCP
> raspberrypi:ssh->183.214.141.105:56265 (ESTABLISHED) sshd      1775   
> sshd    3u  IPv4  16990      0t0  TCP
> raspberrypi:ssh->183.214.141.105:56265 (ESTABLISHED) sshd      1869   
> root    3u  IPv4  17068      0t0  TCP
> raspberrypi:ssh->116.31.116.47:33525 (ESTABLISHED) sshd      1870     
> sshd    3u  IPv4  17068      0t0  TCP
> raspberrypi:ssh->116.31.116.47:33525 (ESTABLISHED) sshd      1910     
> root    3u  IPv4  17122      0t0  TCP
> raspberrypi:ssh->116.31.116.47:35816 (ESTABLISHED) sshd      1911     
> sshd    3u  IPv4  17122      0t0  TCP
> raspberrypi:ssh->116.31.116.47:35816 (ESTABLISHED) sshd      1931     
> root    3u  IPv4  17158      0t0  TCP
> raspberrypi:ssh->116.31.116.47:49492 (ESTABLISHED) sshd      1932     
> sshd    3u  IPv4  17158      0t0  TCP
> raspberrypi:ssh->116.31.116.47:49492 (ESTABLISHED) sshd      1935     
> root    3u  IPv4  17163      0t0  TCP
> raspberrypi:ssh->183.214.141.105:23828 (ESTABLISHED) sshd      1936   
> sshd    3u  IPv4  17163      0t0  TCP
> raspberrypi:ssh->183.214.141.105:23828 (ESTABLISHED) sshd      1937   
> root    3u  IPv4  17168      0t0  TCP
> raspberrypi:ssh->116.31.116.47:53628 (ESTABLISHED) sshd      1938     
> sshd    3u  IPv4  17168      0t0  TCP
> raspberrypi:ssh->116.31.116.47:53628 (ESTABLISHED) sshd      1940     
> root    3u  IPv4  17176      0t0  TCP
> raspberrypi:ssh->116.31.116.47:57858 (ESTABLISHED) sshd      1941     
> sshd    3u  IPv4  17176      0t0  TCP
> raspberrypi:ssh->116.31.116.47:57858 (ESTABLISHED) sshd      1944     
> root    3u  IPv4  17194      0t0  TCP
> raspberrypi:ssh->183.214.141.105:28355 (ESTABLISHED) sshd      1945   
> sshd    3u  IPv4  17194      0t0  TCP
> raspberrypi:ssh->183.214.141.105:28355 (ESTABLISHED)

我已经更改了密码，重新启动了Pi，并检查了是否有任何未知用户(没有)。我如何继续使我的Pi再次安全？

Answer 1

可能有安全漏洞，也可能没有。

可能只是个白痴想强行破解密码。如果他们连接，尝试一个密码，它失败，他们不尝试另一个或关闭连接，然后你可以看到这些连接，最终将被sshd关闭。

/var/log/auth.log

应该有一些关于登录尝试的信息。last命令可能会显示成功登录。