今天系统变慢，服务停止。有这样的日志

ljiayu-nj

系统是CENTOS　4.4，今天变慢，无法telnet，重启后看到这样的日志。
Nov 24 16:31:11 ns sshd[18295]: Failed password for invalid user handsfree from
::ffff:204.112.140.194 port 14763 ssh2
Nov 24 16:31:11 ns sshd[18295]: Received disconnect from ::ffff:204.112.140.194:
11: Bye Bye
Nov 25 00:31:13 ns sshd[18296]: Invalid user hardware from ::ffff:204.112.140.19
4
Nov 24 16:31:13 ns sshd[18300]: input_userauth_request: invalid user hardware
Nov 25 00:31:15 ns sshd[18296]: Failed password for invalid user hardware from :
:ffff:204.112.140.194 port 14991 ssh2
Nov 24 16:31:15 ns sshd[18300]: Failed password for invalid user hardware from :
:ffff:204.112.140.194 port 14991 ssh2
Nov 24 16:31:15 ns sshd[18300]: Received disconnect from ::ffff:204.112.140.194:
11: Bye Bye
Nov 25 00:31:17 ns sshd[18301]: Invalid user harold from ::ffff:204.112.140.194
Nov 24 16:31:17 ns sshd[18302]: input_userauth_request: invalid user harold
Nov 25 00:31:20 ns sshd[18301]: Failed password for invalid user harold from ::f
fff:204.112.140.194 port 15222 ssh2
Nov 24 16:31:20 ns sshd[18302]: Failed password for invalid user harold from ::f
fff:204.112.140.194 port 15222 ssh2
Nov 24 16:31:20 ns sshd[18302]: Received disconnect from ::ffff:204.112.140.194:
11: Bye Bye
Nov 25 00:32:49 ns sshd[18303]: Did not receive identification string from ::fff
f:204.112.140.194
Nov 25 01:18:59 ns xinetd[2369]: START: telnet pid=20358 from=202.99.45.33

看最后一句，这个IP并非我的，而且是在凌晨1时，是被别人攻击了吗？我查了一下这个IP是北京网通的。

qqeyes

这个还不能说明被攻击的

swordfish.cn

貌似有人在穷举密码。
另外说一句，不要用 Telnet 了，用 SSH 吧。

fish007

原帖由 ljiayu-nj 于 2007-11-25 12:08 发表
系统是CENTOS　4.4，今天变慢，无法telnet，重启后看到这样的日志。
Nov 24 16:31:11 ns sshd[18295]: Failed password for invalid user handsfree from
::ffff:204.112.140.194 port 14763 ssh2
Nov 24 16 ...

用netfilter把日志中的IP过滤掉，同时不把telnet禁了吧，用ssh,关掉不用的账号，root密码搞复杂点，并且经常换