我在服务器上的/var/log/auth.log发现了以下错误消息的几次重复：
Aug 10 09:10:16 hostname sshd[661]: error: connect_to 1.1.1.1 port 25: failed.
我更改了实际的IP地址，它们是通常属于邮件服务器的外部地址。
我不明白的是谁正试图连接到这些地址，以及sshd与它有什么关系。 sshd在端口22上运行，该服务器上的端口25上没有任何运行。
这条线究竟意味着什么，谁启动了连接，为什么是sshd？
您可以通过设置SSHdynamic端口转发来重现此操作：
man ssh ：
-D [bind_address:]port Specifies a local “dynamic” application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Cur‐ rently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only root can forward privileged ports. Dynamic port forwardings can also be specified in the configu‐ ration file. IPv6 addresses can be specified by enclosing the address in square brackets. Only the superuser can forward privileged ports. By default, the local port is bound in accordance with the GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a specific address. The bind_address of “localhost” indicates that the listening port be bound for local use only, while an empty address or '*' indicates that the port should be available from all interfaces.
在本地端口2302上启动一个SOCKS代理：
$ ssh -v -ND 2302 user@host
在Firefox中通过此隧道路由HTTPstream量：
编辑 – >首选项 – >高级 – >networking选项卡 – >设置 – >手动代理configuration – > SOCKS主机：本地主机和端口：2302
为了使用其他stream量的SOCKS代理，你可以使用像tsocks这样的socksifier程序：
[I] net-proxy/tsocks Available versions: 1.8_beta5-r3 ~1.8_beta5-r4 1.8_beta5-r5 ~1.8_beta5-r6 {tordns} Installed versions: 1.8_beta5-r5(10:08:28 AM 06/15/2010)(-tordns) Homepage: http://tsocks.sourceforge.net/ Description: Transparent SOCKS v4 proxying library
在我的Gentoo上，编辑/etc/socks/tsocks.conf如下：
# Otherwise we use the server server = 127.0.0.1 server_port = 2302
testing：
$ tsocks telnet 255.255.255.255 25
你会在SSH服务器上的/var/log/secure看到类似这样的内容：
sshd[28491]: error: connect_to 255.255.255.255 port 25: failed.
我不明白的部分是谁正试图连接到这些地址
为了缩小范围，请查看/var/log/secure （发行版中的auth.log ），并在此之前检查已经login的用户：
sshd[26898]: pam_unix(sshd:session): session opened for user quanta
将用户的shell设置为/ bin / false不会阻止ssh端口转发。
http://random.cconn.info/2012/05/06/binfalse-sbinnologin-and-ssh/ http://www.semicomplete.com/articles/ssh-security/
所以我的猜测是，OP的用户login密码太弱或者平凡，通过将shell设置为/ bin / false或/ bin / nologin来“禁用”帐户，并且利用它通过ssh端口转发来发送垃圾邮件。
也许有人login到你的服务器正试图build立一个ssh隧道到1.1.1.1:25？