• 爱搜路由
  • </>
  • 经验心得
  • </>
  • padavan老毛子被SSH远程爆破登录路由器设置远程登录黑白名单
    • 2020
    08-19

    padavan老毛子被SSH远程爆破登录路由器设置远程登录黑白名单

    今天查询日志发现大量这样的信息，搜索一下，应该是正在被远程暴力破解。

    由于家里宽带是公网IP，又开启了SSH，导致路由器被爆破登录。

    padavan老毛子被SSH远程爆破登录

    IP似乎是固定的这个，如何能屏蔽这个IP呢？有经验的坛友请指教一下呗。

    Aug 19 10:59:50 dropbear[22589]: Exit before auth: Exited normally

    Aug 19 11:10:20 dropbear[23565]: Child connection from 141.98.81.42:44711

    Aug 19 11:10:23 dropbear[23565]: Bad password attempt for 'admin' from 141.98.81.42:44711

    Aug 19 11:10:24 dropbear[23565]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:10:25 dropbear[23581]: Child connection from 141.98.81.207:42523

    Aug 19 11:10:27 dropbear[23581]: Bad password attempt for 'admin' from 141.98.81.207:42523

    Aug 19 11:10:28 dropbear[23581]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:10:29 dropbear[23582]: Child connection from 141.98.81.208:37185

    Aug 19 11:10:32 dropbear[23582]: Login attempt for nonexistent user from 141.98.81.208:37185

    Aug 19 11:10:33 dropbear[23582]: Exit before auth: Exited normally

    Aug 19 11:10:33 dropbear[23598]: Child connection from 141.98.81.209:43151

    Aug 19 11:10:36 dropbear[23598]: Bad password attempt for 'admin' from 141.98.81.209:43151

    Aug 19 11:10:36 dropbear[23598]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:10:37 dropbear[23599]: Child connection from 141.98.81.210:38917

    Aug 19 11:10:40 dropbear[23599]: Login attempt for nonexistent user from 141.98.81.210:38917

    Aug 19 11:10:41 dropbear[23599]: Exit before auth: Exited normally

    Aug 19 11:10:41 dropbear[23615]: Child connection from 141.98.81.15:39858

    Aug 19 11:10:44 dropbear[23615]: Login attempt for nonexistent user from 141.98.81.15:39858

    Aug 19 11:10:45 dropbear[23615]: Exit before auth: Exited normally

    Aug 19 11:10:45 dropbear[23616]: Child connection from 141.98.81.42:40047

    Aug 19 11:10:48 dropbear[23616]: Login attempt for nonexistent user from 141.98.81.42:40047

    Aug 19 11:10:49 dropbear[23616]: Exit before auth: Exited normally

    Aug 19 11:10:49 dropbear[23617]: Child connection from 141.98.81.207:44823

    Aug 19 11:10:52 dropbear[23617]: Login attempt for nonexistent user from 141.98.81.207:44823

    Aug 19 11:10:53 dropbear[23617]: Exit before auth: Exited normally

    Aug 19 11:10:53 dropbear[23633]: Child connection from 141.98.81.208:39915

    Aug 19 11:10:56 dropbear[23633]: Login attempt for nonexistent user from 141.98.81.208:39915

    Aug 19 11:10:57 dropbear[23633]: Exit before auth: Exited normally

    Aug 19 11:10:57 dropbear[23634]: Child connection from 141.98.81.209:44223

    Aug 19 11:11:00 dropbear[23634]: Login attempt for nonexistent user from 141.98.81.209:44223

    Aug 19 11:11:01 dropbear[23634]: Exit before auth: Exited normally

    Aug 19 11:11:01 dropbear[23650]: Child connection from 141.98.81.210:40893

    Aug 19 11:11:04 dropbear[23650]: Login attempt for nonexistent user from 141.98.81.210:40893

    Aug 19 11:11:05 dropbear[23650]: Exit before auth: Exited normally

    Aug 19 11:11:05 dropbear[23651]: Child connection from 141.98.81.15:44770

    Aug 19 11:11:08 dropbear[23651]: Login attempt for nonexistent user from 141.98.81.15:44770

    Aug 19 11:11:09 dropbear[23651]: Exit before auth: Exited normally

    Aug 19 11:11:10 dropbear[23652]: Child connection from 141.98.81.42:35837

    Aug 19 11:11:13 dropbear[23652]: Login attempt for nonexistent user from 141.98.81.42:35837

    Aug 19 11:11:14 dropbear[23652]: Exit before auth: Exited normally

    Aug 19 11:11:14 dropbear[23668]: Child connection from 141.98.81.207:39787

    Aug 19 11:11:17 dropbear[23668]: Bad password attempt for 'admin' from 141.98.81.207:39787

    Aug 19 11:11:18 dropbear[23668]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:11:18 dropbear[23669]: Child connection from 141.98.81.208:45883

    Aug 19 11:11:21 dropbear[23669]: Login attempt for nonexistent user from 141.98.81.208:45883

    Aug 19 11:11:22 dropbear[23669]: Exit before auth: Exited normally

    Aug 19 11:11:22 dropbear[23685]: Child connection from 141.98.81.209:35055

    Aug 19 11:11:25 dropbear[23685]: Login attempt for nonexistent user from 141.98.81.209:35055

    Aug 19 11:11:26 dropbear[23685]: Exit before auth: Exited normally

    Aug 19 11:11:26 dropbear[23686]: Child connection from 141.98.81.210:38325

    Aug 19 11:11:29 dropbear[23686]: Bad password attempt for 'admin' from 141.98.81.210:38325

    Aug 19 11:11:30 dropbear[23686]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:11:30 dropbear[23687]: Child connection from 141.98.81.15:50004

    Aug 19 11:11:33 dropbear[23687]: Login attempt for nonexistent user from 141.98.81.15:50004

    Aug 19 11:11:34 dropbear[23687]: Exit before auth: Exited normally

    Aug 19 11:13:32 dropbear[23883]: Child connection from 85.209.0.252:48846

    Aug 19 11:13:32 dropbear[23883]: Exit before auth: Exited normally

    Aug 19 11:13:33 dropbear[23884]: Child connection from 85.209.0.252:41624

    Aug 19 11:13:33 dropbear[23885]: Child connection from 85.209.0.252:41626

    Aug 19 11:13:34 dropbear[23885]: Login attempt for nonexistent user from 85.209.0.252:41626

    Aug 19 11:13:36 dropbear[23885]: Exit before auth: Exited normally

    Aug 19 11:13:36 dropbear[23884]: Login attempt for nonexistent user from 85.209.0.252:41624

    Aug 19 11:13:39 dropbear[23884]: Exit before auth: Exited normally

    Aug 19 11:17:09 dropbear[24201]: Child connection from 87.251.74.30:42172

    Aug 19 11:17:10 dropbear[24201]: Exit before auth: Exited normally

    Aug 19 11:17:10 dropbear[24202]: Child connection from 87.251.74.30:33526

    Aug 19 11:17:10 dropbear[24203]: Child connection from 87.251.74.30:33338

    Aug 19 11:17:12 dropbear[24202]: Login attempt for nonexistent user from 87.251.74.30:33526

    Aug 19 11:17:12 dropbear[24203]: Login attempt for nonexistent user from 87.251.74.30:33338

    Aug 19 11:17:13 dropbear[24219]: Child connection from 87.251.74.30:52856

    Aug 19 11:17:13 dropbear[24202]: Exit before auth: Exited normally

    Aug 19 11:17:13 dropbear[24203]: Exit before auth: Exited normally

    Aug 19 11:17:14 dropbear[24219]: Login attempt for nonexistent user from 87.251.74.30:52856

    Aug 19 11:17:15 dropbear[24219]: Exit before auth: Exited normally

    Aug 19 11:29:36 dropbear[25330]: Child connection from 87.251.74.6:19524

    Aug 19 11:29:36 dropbear[25330]: Exit before auth: Exited normally

    Aug 19 11:29:36 dropbear[25331]: Child connection from 87.251.74.6:34934

    Aug 19 11:29:36 dropbear[25332]: Child connection from 87.251.74.6:40472

    Aug 19 11:29:38 dropbear[25332]: Login attempt for nonexistent user from 87.251.74.6:40472

    Aug 19 11:29:38 dropbear[25331]: Login attempt for nonexistent user from 87.251.74.6:34934

    Aug 19 11:29:40 dropbear[25331]: Exit before auth: Exited normally

    Aug 19 11:29:40 dropbear[25332]: Exit before auth: Exited normally

    Aug 19 11:29:41 dropbear[25333]: Child connection from 87.251.74.6:26390

    Aug 19 11:29:42 dropbear[25333]: Login attempt for nonexistent user from 87.251.74.6:26390

    Aug 19 11:29:43 dropbear[25333]: Exit before auth: Exited normally

    Aug 19 11:44:30 dropbear[26717]: Child connection from 194.180.224.130:43924

    Aug 19 11:44:30 dropbear[26718]: Child connection from 194.180.224.130:43922

    Aug 19 11:44:30 dropbear[26719]: Child connection from 194.180.224.130:43928

    Aug 19 11:44:36 dropbear[26717]: Login attempt for nonexistent user from 194.180.224.130:43924

    Aug 19 11:44:36 dropbear[26718]: Login attempt for nonexistent user from 194.180.224.130:43922

    Aug 19 11:44:38 dropbear[26719]: Bad password attempt for 'admin' from 194.180.224.130:43928

    Aug 19 11:44:41 dropbear[26719]: Exit before auth (user 'admin', 1 fails): Exited normally

    Aug 19 11:44:41 dropbear[26717]: Exit before auth: Exited normally

    Aug 19 11:44:41 dropbear[26718]: Exit before auth: Exited normally

    Aug 19 11:46:17 dropbear[26886]: Child connection from 65.49.20.66:31298

    Aug 19 11:46:18 dropbear[26886]: Login attempt for nonexistent user from 65.49.20.66:31298

    Aug 19 11:46:22 dropbear[26886]: Exit before auth: Exited normally

    Aug 19 11:48:40 dropbear[27097]: Child connection from 187.16.255.102:41142

    Aug 19 11:48:40 dropbear[27097]: Exit before auth: Exited normally

    Aug 19 12:07:12 dropbear[28779]: Child connection from 187.16.255.102:54228

    Aug 19 12:07:12 dropbear[28779]: Exit before auth: Exited normally

    现在先把SSH关闭了，等需要用了 再打开。

    限制ip ssh远程登录

    有时候为了服务器的安全考虑，我们可以在服务器上做限制，禁止其他ip地址连接服务器。

    方法一：修改ssh配置文件

    其实做这个操作很简单，只需要改/etc/ssh/sshd_config配置文件，再最后一行添加下面语句即可

    allowusers root@49.4.151.24         ##注意此处添加的ip地址应为内网出口的公网ip地址，而不是局域网的内网
ipallowusers root@1.119.144.11         ##可以添加多行，表示容许多个ip访问服务器

    修改完毕后重启ssh

    /etc/init.d/sshd restart

    测试

    可以新建个用户，然后使用新用户登录，看能否登录上；还可以让朋友登录测试

    如果测试过程中有问题，可以看登录日志

    tail -f  /var/log/secure

    日志中就可以看出来，我设置的内网ip并没有出现在日志中，而是一个公网ip，由此可以看出，配置文件识别的是公网ip（此也可以看出来自己的公网ip地址），修改配置文件

    中的内网ip为公网ip后，测试通过。

    方法二：修改两个配置文件

    /etc/hosts.allow和/etc/hosts.deny

    /etc/hosts.allow和/etc/hosts.deny两个文件是控制远程访问设置的，通过他可以允许或者拒绝某个ip或者ip段的客户访问linux的某项服务。

    比如SSH服务，我们通常只对管理员开放，那我们就可以禁用不必要的IP，而只开放管理员可能使用到的IP段；

    首先编辑允许连接服务器的ip，即可以放行的ip

    Vim /etc/hosts.allow

    添加一行

    sshd:49.4.151.24:allow                            #此处ip仍然为局域网出口的公网ip

    如果有多台服务器，比如我们有多台云服务器，那么这个允许的ip地址可能不一样，可以在登录服务器上会有ip地址提示，如下

    然后编辑禁止连接服务器的ip地址

    vim /etc/hosts.deny

    输入(表示除了上面允许的，其他的ip 都拒绝登陆ssh)

    sshd:ALL

    编辑完上面两个文件后，无需重启任何配置文件，即时生效

    上面两种方法对比的区别在于第一种方法限制范围更强，不仅限制了ip，而且用户不对，也登录不了服务器；

    第二种方法只限制了ip地址，只要密码正确，用户名不同也可以登录，这种适用于局域网中有多人需要登录服务器的需求。

    注意：

    /etc/hosts.deny中的设置会影响ansible远程管理，如果需要ansible管理，可以将ansible所在的服务器地址（如果使用的私网ip，那么添加私网ip）添加到/etc/hosts.allow中

    sshd:10.172.288.60:allow

    支付宝消费券福利分享


    支付宝扫码加入支付宝消费券活动

    您可能感兴趣的文章

    如果本文对你有帮助，那么请你赞助我，让我更有激情的写下去，帮助更多的人。
    本站加入了Google AdSense，因为谷歌 AdSense 算是广告商里难得“有节操、有底线”的佼佼者，没有任何低俗、垃圾、恶心的广告，所有希望不要“一刀切”式的拦截广告

    如无特殊说明，解压密码均为：aisoa.cn
    本站附件分享，如附件失效，可以去找找看
    诚通网盘附件、百度网盘附件正在以10KB/s的速度下载，请耐心等待。

    赏支付宝打赏支付宝打赏微信打赏微信打赏

    您可能还会对这些文章感兴趣！