紧急求救，网站正在受攻击中，我该怎么办？附攻击记录

pingasi

谢谢大家，网站正在受攻击中。。。。。。我该怎么办？
Jul 18 22:54:53 www sshd[32551]: Illegal user emails from 64.62.253.203
Jul 18 22:54:55 www sshd[32571]: Illegal user ftpadmin from 64.62.253.203
Jul 18 22:54:56 www sshd[32591]: Illegal user family from 64.62.253.203
Jul 18 22:54:58 www sshd[32602]: Illegal user encrypt from 64.62.253.203
Jul 18 22:54:59 www sshd[32622]: Illegal user fire from 64.62.253.203
Jul 18 22:55:01 www sshd[32633]: Illegal user fox from 64.62.253.203
Jul 18 22:55:02 www sshd[32653]: Illegal user faq from 64.62.253.203
Jul 18 22:55:04 www sshd[32664]: Illegal user pay from 64.62.253.203
Jul 18 22:55:06 www sshd[32684]: Illegal user payment from 64.62.253.203
Jul 18 22:55:08 www sshd[32695]: Illegal user payments from 64.62.253.203
Jul 18 22:55:09 www sshd[32715]: Illegal user paypal from 64.62.253.203
Jul 18 22:55:11 www sshd[32735]: Illegal user office from 64.62.253.203
Jul 18 22:55:13 www sshd[32755]: Illegal user order from 64.62.253.203
Jul 18 22:55:18 www sshd[32767]: Failed password for news from 64.62.253.203 port 39061 ssh2

pingasi

谢谢大家，我用redhat9,我不熟悉，我该怎么办？

双眼皮的猪

汗...
#iptables -A INPUT -p tcp --dport 22 -s 64.62.253.203 -j DROP

如果他不换ip的话用root在命令行下执行一下,我就不解释了

platinum

原帖由 "双眼皮的猪" 发表：
汗...
#iptables -A INPUT -p tcp --dport 22 -s 64.62.253.203 -j DROP

如果他不换ip的话用root在命令行下执行一下,我就不解释了

如果前面有 -p tcp --dport 22 -j ACCEPT，-A 就失效了，需要用 -I

双眼皮的猪

恩.同意^_^
回家的感觉???
我也辞职了

zhangweibo

没事，只是试探性的扫描，不用紧张，我的服务器几乎每天都有

Yuri.G.

原帖由 "双眼皮的猪" 发表：
汗...
#iptables -A INPUT -p tcp --dport 22 -s 64.62.253.203 -j DROP

如果他不换ip的话用root在命令行下执行一下,我就不解释了

干么要drop呢?直接给它reject回去.

jervis0211

高手过招呀，小鸟路过

ammy

[quote]原帖由 "jervis0211"]高手过招呀，小鸟路过[/quote 发表：


蜂鸟也飞过

platinum

原帖由 "Yuri.G." 发表：

干么要drop呢?直接给它reject回去.

为什么要 REJECT 呢？