Linux – 安全 – 有人试图find一个方法吗？

可能重复：
数百个失败的sshlogin

最近，我花了更多的时间在我的生产服务器上努力伪装几个configuration，而我偶然发出了一个find /var/log -mmin1 ，它返回了/var/log/secure文件等等。 对最近被logging到这个特定文件的活动感到好奇，我开始跟踪它，并logging了其中的一些条目：

 Jan 9 22:15:59 myhost sshd[22916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache Jan 9 22:16:01 myhost sshd[22916]: Failed password for apache from 58.213.48.82 port 36464 ssh2 Jan 9 22:16:01 myhost sshd[22917]: Received disconnect from 58.213.48.82: 11: Bye Bye Jan 9 22:16:03 myhost unix_chkpwd[22922]: password check failed for user (apache) Jan 9 22:16:03 myhost sshd[22919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache Jan 9 22:16:04 myhost sshd[22919]: Failed password for apache from 58.213.48.82 port 37392 ssh2 Jan 9 22:16:05 myhost sshd[22920]: Received disconnect from 58.213.48.82: 11: Bye Bye Jan 9 22:16:06 myhost unix_chkpwd[22925]: password check failed for user (apache) Jan 9 22:16:06 myhost sshd[22923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.48.82 user=apache Jan 9 22:16:08 myhost sshd[22923]: Failed password for apache from 58.213.48.82 port 38244 ssh2 Jan 9 22:16:08 myhost sshd[22924]: Received disconnect from 58.213.48.82: 11: Bye Bye 

不太友善，但我注意到，请求来自保存IP地址目的地不同的本地端口。 所以我做了一个whois 58.213.48.82 ，它回来了这个：

 [Querying whois.apnic.net] [whois.apnic.net] % [whois.apnic.net node-4] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html inetnum: 58.208.0.0 - 58.223.255.255 netname: CHINANET-JS descr: CHINANET jiangsu province network descr: China Telecom descr: A12,Xin-Jie-Kou-Wai Street descr: Beijing 100088 country: CN admin-c: CH93-AP tech-c: CJ186-AP mnt-by: APNIC-HM mnt-lower: MAINT-CHINANET-JS mnt-routes: MAINT-CHINANET-JS .... 

这再次看起来不友好。 那么这是一个潜在的攻击看起来像什么？ 我该如何处理呢？ 在IPTables中设置一个条目来阻止来自给定IP的任何请求？

• Nginx的 – 防止.php文件运行在任何东西，但你自己的服务器/域？
• 有没有办法允许非root用户的特定权限？
• 如何确保在命令行上input的密码在Linux服务器上完全不存储？
• 停止服务器用作代理
• 什么types的安全威胁的vlan防范？

 DROP all -- 124.202.129.123 anywhere DROP all -- 183.61.135.236 anywhere DROP all -- mailhost.best.server.h2omedia.de anywhere DROP all -- ip223.hichina.com anywhere DROP all -- 124.202.129.124 anywhere DROP all -- 59.46.172.67 anywhere DROP all -- 198.15.109.254 anywhere DROP all -- 61.183.35.3 anywhere DROP all -- 122.225.107.98 anywhere DROP all -- 61.142.106.34 anywhere DROP all -- customer-201-96-126-213.uninet-ide.com.mx anywhere DROP all -- 122.155.222.4 anywhere DROP all -- 114.80.116.124 anywhere DROP all -- 202.153.46.18 anywhere DROP all -- cncln.online.ln.cn anywhere DROP all -- 222.28.155.2 anywhere DROP all -- ns.km22643.keymachine.de anywhere DROP all -- 111.74.82.33 anywhere DROP all -- 119.188.3.56 anywhere DROP all -- 60.174.198.14 anywhere DROP all -- 123.127.160.102 anywhere DROP all -- 202.29.16.59 anywhere DROP all -- wsc.jalamobile.net anywhere DROP all -- 58.248.62.48 anywhere DROP all -- 211.161.45.136 anywhere DROP all -- 153.128.19.93 anywhere DROP all -- 50.22.249.204-static.reverse.softlayer.com anywhere DROP all -- 58.252.68.177 anywhere DROP all -- fire.deltax.com.br anywhere DROP all -- 117.79.80.242 anywhere DROP all -- 202.202.232.202 anywhere RETURN all -- anywhere anywhere