环境:CentOS (其他发行版略有不同)
本文适合具备linux基础的同学
确认自己的登录信息以及目前登陆服务器的用户
列出所有登陆账户
w
列出当前账户
who am i
1、查看成功登陆日志
指令:
cd /var/log
less secure | grep 'Accepted'
正常登陆状态日志:
月份 日期 时分秒 服务器主机名 程序(sshd或则su) 模块 详细信息
Nov 19 09:36:56 iz2**9w***8l***vz sshd[2***]: Accepted password for root from 1*.*.*.*
port *** ssh2
Nov 19 09:36:56 iz2**9w***8l***vz sshd[2***]: pam_unix(sshd:session): session opened for user
root by (uid=*)
正常退出登录日志:
Aug 8 02:01:38 i****y sshd[18252]: pam_unix(sshd:session): session closed for user root
2、连接到服务器,提示输入密码时取消了
日志:
Aug 8 02:31:03 imzcy sshd[19046]: Received disconnect from 192.*.*.*: 13: The user canceled authentication.
3、密码输入错误
日志:
Aug 8 02:33:28 imzcy sshd[19125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.*.*.* user=root
Aug 8 02:33:31 imzcy sshd[19125]: Failed password for root from 192.*.*.* port 57994 ssh2
4、密码错误次数太多
日志:
Nov 19 09:36:56 imzcy sshd[19125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.217.10 user=root
Nov 19 09:36:56 imzcy sshd[19125]: Failed password for root from 192.168.217.10 port 57994 ssh2
Nov 19 09:36:56 imzcy last message repeated 3 times
Nov 19 09:36:56 imzcy last message repeated 2 times
Nov 19 09:36:56 imzcy sshd[19126]: Disconnecting: Too many authentication failures for root
Nov 19 09:36:56 imzcy sshd[19125]: Failed password for root from 192.168.217.10 port 57994 ssh2
Nov 19 09:36:56 imzcy sshd[19125]: PAM 6 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.217.10 user=root
Nov 19 09:36:56 imzcy sshd[19125]: PAM service(sshd) ignoring max retries; 7 > 3
如果出现爆破手最简单的处理方式先禁用对方ip,或者限制到某台机器可以访问
如:我们只允许192.168.0.3的机器进行SSH连接
[root@tp ~]# iptables -A INPUT -s 192.168.0.3 -p tcp --dport 22 -j ACCEPT
更具体的操作可以使用iptables设置相应规则