ssh暴力破解

jacson007

最近查看日志发现一台服务器受到大量的ssh密码验证失败的信息。日志信息在下面：

有什么好办法防范这种攻击呢？

我是想把这些攻击的主机IP过滤出来加到/etc/hosts.deny里面

请问改怎么写过滤语句？过滤结果就是一个IP一行。



Jun 22 18:49:46 localhost sshd[4128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:49:46 localhost sshd[4133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:49:51 localhost sshd[4152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:49:51 localhost sshd[4157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:49:56 localhost sshd[4176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:49:56 localhost sshd[4181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:01 localhost sshd[4199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:01 localhost sshd[4205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:06 localhost sshd[4223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:06 localhost sshd[4226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:10 localhost sshd[4244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:10 localhost sshd[4248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:15 localhost sshd[4268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:15 localhost sshd[4273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:19 localhost sshd[4288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:20 localhost sshd[4297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:23 localhost sshd[4299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:24 localhost sshd[4313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:27 localhost sshd[4323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:28 localhost sshd[4330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:28 localhost sshd[4339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:32 localhost sshd[4357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:33 localhost sshd[4359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:36 localhost sshd[4366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:37 localhost sshd[4384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:38 localhost sshd[4385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:41 localhost sshd[4404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:42 localhost sshd[4407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:43 localhost sshd[4412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:50:45 localhost sshd[4426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:51:39 localhost sshd[4708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80
Jun 22 18:51:43 localhost sshd[4726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.35.145.80

chenyx

ssh用key验证,不允许密码登陆

vermouth

可以在 iptables 上面加个限制，参考：http://linux.chinaunix.net/bbs/thread-578382-1-1.html

jacson007

原帖由 chenyx 于 2009-6-24 15:23 发表
ssh用key验证,不允许密码登陆

是有key验证，但是好像第一次登陆成功就会自动生成key了

aredfox

以前找到过一个插件，可以限制一个ip的尝试次数，几次不对之后就对这个ip禁止连接。（时间可以选）

emmoblin

ssh可以设置尝试次数

molecar

我也遇到过类似的问题。修改一下SSH端口就行了

linuxnature

原帖由 chenyx 于 2009-6-24 15:23 发表
ssh用key验证,不允许密码登陆

恩。这种方法安全。

sgcqh_82

封他IP

polokus

设置下尝试登陆次数就好了