全球主机交流论坛

标题: 云筏cloudraft 0.1小鸡被ssh爆破了 [打印本页]
作者: emptysuns    时间: 2022-1-7 14:03
标题: 云筏cloudraft 0.1小鸡被ssh爆破了
本帖最后由 emptysuns 于 2022-1-7 14:11 编辑

刚在论坛发了帖子
ssh就被正在爆破
你是真的闲
https://loc.888543.xyz/forum.php?mo ... ;page=3#pid11760668
通过ipv4 nat 过来的看不到源ip


  1. Jan  7 05:59:49 node3459-vzvps-189 sshd[34476]: Received disconnect from 172.31.1.17 port 38852:11: Normal Shutdown, Thank you for playing [preauth]
  2. Jan  7 05:59:49 node3459-vzvps-189 sshd[34476]: Disconnected from invalid user rym 172.31.1.17 port 38852 [preauth]
  3. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: Invalid user liangt from 172.31.1.17 port 60402
  4. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: pam_unix(sshd:auth): check pass; user unknown
  5. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
  6. Jan  7 05:59:49 node3459-vzvps-189 sshd[34543]: Received disconnect from 172.31.1.17 port 40782:11: Normal Shutdown, Thank you for playing [preauth]
  7. Jan  7 05:59:49 node3459-vzvps-189 sshd[34543]: Disconnected from invalid user szl 172.31.1.17 port 40782 [preauth]
  8. Jan  7 05:59:49 node3459-vzvps-189 sshd[34565]: Failed password for invalid user xiaoke_wh from 172.31.1.17 port 51330 ssh2
  9. Jan  7 05:59:49 node3459-vzvps-189 sshd[34517]: Received disconnect from 172.31.1.17 port 45702:11: Normal Shutdown, Thank you for playing [preauth]
  10. Jan  7 05:59:49 node3459-vzvps-189 sshd[34517]: Disconnected from invalid user fangh 172.31.1.17 port 45702 [preauth]
  11. Jan  7 05:59:49 node3459-vzvps-189 sshd[34519]: Received disconnect from 172.31.1.17 port 43088:11: Normal Shutdown, Thank you for playing [preauth]
  12. Jan  7 05:59:49 node3459-vzvps-189 sshd[34519]: Disconnected from invalid user ypy 172.31.1.17 port 43088 [preauth]
  13. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: Invalid user hwl-cgy from 172.31.1.17 port 50308
  14. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: Invalid user jxl from 172.31.1.17 port 57194
  15. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: pam_unix(sshd:auth): check pass; user unknown
  16. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
  17. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: pam_unix(sshd:auth): check pass; user unknown
  18. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
  19. Jan  7 05:59:49 node3459-vzvps-189 sshd[34338]: Received disconnect from 172.31.1.17 port 48664:11: Normal Shutdown, Thank you for playing [preauth]
  20. Jan  7 05:59:49 node3459-vzvps-189 sshd[34338]: Disconnected from invalid user qinsiqing 172.31.1.17 port 48664 [preauth]
  21. Jan  7 05:59:49 node3459-vzvps-189 sshd[34541]: Failed password for invalid user zsw from 172.31.1.17 port 48884 ssh2
  22. Jan  7 05:59:49 node3459-vzvps-189 sshd[34626]: Failed password for invalid user zhangjing from 172.31.1.17 port 56754 ssh
  23. root@xxxxx:/var/log# date
  24. Fri 07 Jan 2022 06:00:43 AM UTC
复制代码



现在已经停了。估计是针对        ipv4网关us-host-1.paas-us.cloud.ac.cn 进行扫的
云筏客户可以来瞅瞅
作者: stingeo    时间: 2022-1-7 14:04
爆破好，祝早破。
作者: 赵蜇    时间: 2022-1-7 14:05
6位数字公网V4我也没见谁爆破成功了
作者: MoeWang    时间: 2022-1-7 14:05
不方便看源ip的话还不方便用fail2ban
作者: 表妹    时间: 2022-1-7 14:07
提示: 作者被禁止或删除 内容自动屏蔽
作者: imslc    时间: 2022-1-7 14:08
关机保平安
作者: emptysuns    时间: 2022-1-7 14:09
MoeWang 发表于 2022-1-7 14:05
不方便看源ip的话还不方便用fail2ban

fail2ban, 云筏放出的试用鸡，根本性能不足，随随便便都能被打满cpu，删掉v4中转了，看看这位有本事扫v6地址不



欢迎光临 全球主机交流论坛 (https://loc.888543.xyz/) Powered by Discuz! X3.4