云筏cloudraft 0.1小鸡被ssh爆破了

emptysuns

刚在论坛发了帖子
ssh就被正在爆破
你是真的闲
https://loc.888543.xyz/forum.php?mo ... ;page=3#pid11760668
通过ipv4 nat 过来的看不到源ip

1. Jan  7 05:59:49 node3459-vzvps-189 sshd[34476]: Received disconnect from 172.31.1.17 port 38852:11: Normal Shutdown, Thank you for playing [preauth]
   
2. Jan  7 05:59:49 node3459-vzvps-189 sshd[34476]: Disconnected from invalid user rym 172.31.1.17 port 38852 [preauth]
   
3. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: Invalid user liangt from 172.31.1.17 port 60402
   
4. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: pam_unix(sshd:auth): check pass; user unknown
   
5. Jan  7 05:59:49 node3459-vzvps-189 sshd[34651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
   
6. Jan  7 05:59:49 node3459-vzvps-189 sshd[34543]: Received disconnect from 172.31.1.17 port 40782:11: Normal Shutdown, Thank you for playing [preauth]
   
7. Jan  7 05:59:49 node3459-vzvps-189 sshd[34543]: Disconnected from invalid user szl 172.31.1.17 port 40782 [preauth]
   
8. Jan  7 05:59:49 node3459-vzvps-189 sshd[34565]: Failed password for invalid user xiaoke_wh from 172.31.1.17 port 51330 ssh2
   
9. Jan  7 05:59:49 node3459-vzvps-189 sshd[34517]: Received disconnect from 172.31.1.17 port 45702:11: Normal Shutdown, Thank you for playing [preauth]
   
10. Jan  7 05:59:49 node3459-vzvps-189 sshd[34517]: Disconnected from invalid user fangh 172.31.1.17 port 45702 [preauth]
    
11. Jan  7 05:59:49 node3459-vzvps-189 sshd[34519]: Received disconnect from 172.31.1.17 port 43088:11: Normal Shutdown, Thank you for playing [preauth]
    
12. Jan  7 05:59:49 node3459-vzvps-189 sshd[34519]: Disconnected from invalid user ypy 172.31.1.17 port 43088 [preauth]
    
13. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: Invalid user hwl-cgy from 172.31.1.17 port 50308
    
14. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: Invalid user jxl from 172.31.1.17 port 57194
    
15. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: pam_unix(sshd:auth): check pass; user unknown
    
16. Jan  7 05:59:49 node3459-vzvps-189 sshd[34549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
    
17. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: pam_unix(sshd:auth): check pass; user unknown
    
18. Jan  7 05:59:49 node3459-vzvps-189 sshd[34628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.31.1.17
    
19. Jan  7 05:59:49 node3459-vzvps-189 sshd[34338]: Received disconnect from 172.31.1.17 port 48664:11: Normal Shutdown, Thank you for playing [preauth]
    
20. Jan  7 05:59:49 node3459-vzvps-189 sshd[34338]: Disconnected from invalid user qinsiqing 172.31.1.17 port 48664 [preauth]
    
21. Jan  7 05:59:49 node3459-vzvps-189 sshd[34541]: Failed password for invalid user zsw from 172.31.1.17 port 48884 ssh2
    
22. Jan  7 05:59:49 node3459-vzvps-189 sshd[34626]: Failed password for invalid user zhangjing from 172.31.1.17 port 56754 ssh
    
23. root@xxxxx:/var/log# date
    
24. Fri 07 Jan 2022 06:00:43 AM UTC
    

复制代码

现在已经停了。估计是针对        ipv4网关us-host-1.paas-us.cloud.ac.cn 进行扫的
云筏客户可以来瞅瞅

stingeo

爆破好，祝早破。

emptysuns

MoeWang 发表于 2022-1-7 14:05
不方便看源ip的话还不方便用fail2ban

fail2ban, 云筏放出的试用鸡，根本性能不足，随随便便都能被打满cpu，删掉v4中转了，看看这位有本事扫v6地址不

imslc

关机保平安

MoeWang

不方便看源ip的话还不方便用fail2ban

赵蜇

6位数字公网V4我也没见谁爆破成功了