![阻止所有传出的 ssh 流量](https://linux22.com/image/760950/%E9%98%BB%E6%AD%A2%E6%89%80%E6%9C%89%E4%BC%A0%E5%87%BA%E7%9A%84%20ssh%20%E6%B5%81%E9%87%8F.png)
我的 EC2 实例报告有可疑活动,我收到了以下电子邮件:
涉嫌参与类似于在互联网上扫描远程主机以查找安全漏洞的活动。AWS 可接受使用政策 (https://aws.amazon.com/aup/)我们已将原始报告附在下面,供您查阅。
请采取措施停止所报告的活动,并直接回复此电子邮件,详细说明您已采取的纠正措施。如果您认为这些报告中描述的活动不属于滥用行为,请回复此电子邮件,详细说明您的使用案例。
如果您不知道此活动,则您的环境可能已被外部攻击者入侵,或者存在漏洞,允许您的机器以非预期的方式被使用。
我不知道如何检查发生了什么。我更改了 root 密码,但仍然收到相同的活动报告。
以下是日志:
Full logs:
(time in UTC)=2020-12-08T23:59:13 (attacker's IP)=myip (IP being scanned)=91^208^184^50 (TCP port being scanned)=523
(time in UTC)=2020-12-08T23:59:21 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=2025
(time in UTC)=2020-12-08T23:59:28 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=841
(time in UTC)=2020-12-08T23:59:42 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=10699
(time in UTC)=2020-12-08T23:59:54 (attacker's IP)=myip (IP being scanned)=78^128^99^30 (TCP port being scanned)=1298
(time in UTC)=2020-12-09T23:57:40 (attacker's IP)=myip (IP being scanned)=219^91^85^19 (TCP port being scanned)=313
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=219^91^62^21 (TCP port being scanned)=21735
(time in UTC)=2020-12-09T23:57:43 (attacker's IP)=myip (IP being scanned)=91^203^192^19 (TCP port being scanned)=984
(time in UTC)=2020-12-09T23:57:52 (attacker's IP)=myip (IP being scanned)=185^178^44^132 (TCP port being scanned)=18263
(time in UTC)=2020-12-09T23:57:53 (attacker's IP)=myip (IP being scanned)=140^238^172^100 (TCP port being scanned)=1389
另一份日志:
Logs:
------------------------------------------------------------------------
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: Invalid user test from myip port 44682
Dec 9 01:01:55 kmh-wmh-003-nbg03 sshd[698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Failed password for invalid user test from myip port 44682 ssh2
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Received disconnect from myip port 44682:11: Bye Bye [preauth]
Dec 9 01:01:57 kmh-wmh-003-nbg03 sshd[698]: Disconnected from myip port 44682 [preauth]
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: Invalid user pppuser from myip port 41660
Dec 9 01:18:16 kmh-wmh-003-nbg03 sshd[2480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Failed password for invalid user pppuser from myip port 41660 ssh2
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Received disconnect from myip port 41660:11: Bye Bye [preauth]
Dec 9 01:18:17 kmh-wmh-003-nbg03 sshd[2480]: Disconnected from myip port 41660 [preauth]
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: Invalid user master from myip port 38852
Dec 9 01:21:25 kmh-wmh-003-nbg03 sshd[2792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myip
因为我从不使用我的实例连接到 ssh,所以我只想阻止来自任何用户和任何应用程序/进程的所有传出 SSH 流量。如何做到这一点?
也许我可以使用 iptables 阻止所有到端口 22 的传出流量,但不能阻止所有使用端口 22 的 ssh,对吗?还有其他有效的方法吗?
答案1
事情没那么简单。如果你的服务器被入侵了,你就得调查。
首先,阻止所有传入流量,但您的服务(例如,端口 80 和 443)阻止来自任何来源的 ssh 访问,但您的。
其次,我建议开始安装和运行 clamav、chkrootkit 和 rkhunter 等软件。这些软件可以扫描你的机器并识别几个众所周知的漏洞。
三、查看所有正在运行的进程、日志等
第四,对你的机器应用一些强化技术
答案2
检查您的“安全组”,如果有端口 22/SSH 服务的入站规则,请将其删除。
如果您从不执行 ssh,那么您运行的是哪些服务?