现在我已经登录到我的 digitalocean 盒子，我可以在日志中清楚地看到这一点，我猜某种脚本正在试图闯入：
Mar 8 13:25:25 sshd[11311]: Invalid user schedule from 216.157.31.144
Mar 8 13:25:25 sshd[11311]: input_userauth_request: invalid user schedule [preauth]
Mar 8 13:25:25 sshd[11311]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:25:25 sshd[11311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144
Mar 8 13:25:27 sshd[11311]: Failed password for invalid user schedule from 216.157.31.144 port 32774 ssh2
Mar 8 13:25:27 sshd[11311]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar 8 13:26:26 sshd[11313]: reverse mapping checking getaddrinfo for new.mega.nn.ru [93.183.127.194] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 8 13:26:26 sshd[11313]: Invalid user toor from 93.183.127.194
Mar 8 13:26:26 sshd[11313]: input_userauth_request: invalid user toor [preauth]
Mar 8 13:26:26 sshd[11313]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:26:26 sshd[11313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.183.127.194
Mar 8 13:26:28 sshd[11313]: Failed password for invalid user toor from 93.183.127.194 port 48789 ssh2
Mar 8 13:26:28 sshd[11313]: Received disconnect from 93.183.127.194: 11: Bye Bye [preauth]
Mar 8 13:28:08 sshd[11315]: Invalid user administrator from 24.24.96.163
Mar 8 13:28:08 sshd[11315]: input_userauth_request: invalid user administrator [preauth]
Mar 8 13:28:08 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:08 sshd[11315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163
Mar 8 13:28:09 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:10 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:12 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:12 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:14 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar 8 13:28:14 sshd[11315]: Connection closed by 24.24.96.163 [preauth]
Mar 8 13:28:14 sshd[11315]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163
Mar 8 13:28:18 sshd[11317]: Did not receive identification string from 80.78.102.189
Mar 8 13:28:19 sshd[11318]: reverse mapping checking getaddrinfo for zbmo-ll.umn.ru [80.78.102.189] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 8 13:28:19 sshd[11318]: Invalid user admin from 80.78.102.189
Mar 8 13:28:19 sshd[11318]: input_userauth_request: invalid user admin [preauth]
Mar 8 13:28:19 sshd[11318]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:28:19 sshd[11318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.102.189
Mar 8 13:28:21 sshd[11318]: Failed password for invalid user admin from 80.78.102.189 port 50953 ssh2
Mar 8 13:28:21 sshd[11318]: Connection closed by 80.78.102.189 [preauth]
Mar 8 13:31:03 sshd[11331]: Invalid user schiko from 216.157.31.144
Mar 8 13:31:03 sshd[11331]: input_userauth_request: invalid user schiko [preauth]
Mar 8 13:31:03 sshd[11331]: pam_unix(sshd:auth): check pass; user unknown
Mar 8 13:31:03 sshd[11331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144
Mar 8 13:31:04 sshd[11331]: Failed password for invalid user schiko from 216.157.31.144 port 20222 ssh2
Mar 8 13:31:04 sshd[11331]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar 8 13:31:48 sshd[11333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:31:50 sshd[11333]: Failed password for root from 125.88.177.90 port 27353 ssh2
Mar 8 13:31:55 sshd[11333]: last message repeated 2 times
Mar 8 13:31:55 sshd[11333]: Received disconnect from 125.88.177.90: 11: [preauth]
Mar 8 13:31:55 sshd[11333]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:31:58 sshd[11335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:00 sshd[11335]: Failed password for root from 125.88.177.90 port 57212 ssh2
Mar 8 13:32:05 sshd[11335]: last message repeated 2 times
Mar 8 13:32:05 sshd[11335]: Received disconnect from 125.88.177.90: 11: [preauth]
Mar 8 13:32:05 sshd[11335]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:08 sshd[11337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90 user=root
Mar 8 13:32:10 sshd[11337]: Failed password for root from 125.88.177.90 port 35022 ssh2
Mar 8 13:32:15 sshd[11337]: last message repeated 2 times
Mar 8 13:32:15 sshd[11337]: Received disconnect from 125.88.177.90: 11: [preauth]
我看到有多个IP正在尝试访问它以进入！
做完之后lsof -i | less
我在输出末尾的某个地方看到了这个，我猜这个 125-ip 是否存在？
sshd 11548 root 3r IPv4 5046701 0t0 TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
sshd 11549 sshd 3u IPv4 5046701 0t0 TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
我正在使用我的私钥作为无密码 ssh 登录来访问 Droplet，但据我所知，如果密码被猜到，root 用户仍然可以登录，对吧？
答案1
您没有提供有关您的任何信息sshd_config，但是开始的好地方，您使用的公钥身份验证完全拒绝密码身份验证并拒绝 root 登录：
PermitRootLogin no # or without-password if you need that login
PasswordAuthentication no
ChallengeResponseAuthentication no
如果不允许密码验证，您将摆脱几乎所有的攻击。对公钥认证进行攻击是不可行的。