Forum
Aktif konular
Üyeler
Kurallar
Arama
Linux Güvenliği Hakkında Soru (Vps) Linux Güvenliği Hakkında Soru (Vps)
-
arkadaşlar vps'de loglara bakarken /var/log/syslog içinde şöyle kayıtlar var:
Dec 29 17:23:01 vpn CRON[1685]: (root) CMD (cd / && run-parts --report /etc/cron.hourly)
Dec 29 17:41:57 vpn CRON[1696]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 18:00:13 vpn CRON[1719]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 18:24:58 vpn CRON[1747]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 18:25:32 vpn CRON[1750]: (root) CMD (cd / && run-parts --report /etc/cron.hourly)
Dec 29 18:40:15 vpn CRON[1786]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 19:00:26 vpn CRON[1817]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 19:20:09 vpn CRON[1848]: (smmsp) CMD (test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp)
Dec 29 19:23:18 vpn CRON[1867]: (root) CMD (cd / && run-parts --report /etc/cron.hourly)böyle gidiyor, bu cron dediği cron jobs mı, eğer öylerse bu sürekli sendmail ile bi yerlere mail mi gönderiyor? ben sendmail ile ilgili hiçbir şey yapmadım bu nedir?
ikincisi /var/log/auth.log içinde şöyle kayıtlar var:
Dec 29 23:57:38 vpn sshd[2360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.143.227.145 user=root
Dec 29 23:57:40 vpn sshd[2360]: Failed password for root from 195.143.227.145 port 56823 ssh2
Dec 29 23:57:47 vpn last message repeated 3 times
Dec 29 23:57:47 vpn sshd[2360]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.143.227.145 user=root
Dec 29 23:57:47 vpn sshd[2360]: PAM service(sshd) ignoring max retries; 4 > 3sanırım bu ingiliz ip'sinden girmeye çalışmış hep aynı porttan 3 kereden sonra izin verilmemiş
Dec 29 22:16:03 vpn sshd[2123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.34.3 user=root
Dec 29 22:16:05 vpn sshd[2123]: Failed password for root from 221.13.34.3 port 46130 ssh2
Dec 29 22:16:08 vpn sshd[2125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.34.3 user=root
Dec 29 22:16:10 vpn sshd[2125]: Failed password for root from 221.13.34.3 port 48365 ssh2
Dec 29 22:16:18 vpn sshd[2127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.34.3 user=root
Dec 29 22:16:20 vpn sshd[2127]: Failed password for root from 221.13.34.3 port 49525 ssh2
Dec 29 22:16:30 vpn sshd[2129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.34.3 user=root
Dec 29 22:16:31 vpn sshd[2129]: Failed password for root from 221.13.34.3 port 51598 ssh2
burdaysa çinli uyanık her seferinde farklı porttan denemişbunun gibi yüzlerce kayıt oluşturulmuş log dosyasında, bu adamlara karşı nasıl bir önlem alabilirim?
bir de şöyle bir şey var:
Dec 29 22:59:15 vpn sshd[2228]: reverse mapping checking getaddrinfo for cncln.online.ln.cn [218.60.59.18] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 29 22:59:15 vpn sshd[2228]: Invalid user informix from 218.60.59.18
Dec 29 22:59:15 vpn sshd[2228]: pam_unix(sshd:auth): check pass; user unknown
Dec 29 22:59:15 vpn sshd[2228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.60.59.18
Dec 29 22:59:17 vpn sshd[2228]: Failed password for invalid user informix from 218.60.59.18 port 40043 ssh2 -
Sitende ne kurulu?
-
site yok ubuntu üzerinde sadece pptp server var
-
up
Kısayol
Şikayet
Özel Mesaj
Alıntı yap
Cevapla