我使用亚马逊EC2，我有公钥encryption。
我正在检查/var/log/secure文件，我得到这个
Jul 17 21:14:18 server sshd[26590]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:18 server sshd[26591]: input_userauth_request: invalid user net Jul 17 21:14:18 server sshd[26591]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:22 server sshd[26592]: Invalid user internet from 195.189.62.29 Jul 17 21:14:22 server sshd[26592]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:22 server sshd[26593]: input_userauth_request: invalid user internet Jul 17 21:14:22 server sshd[26593]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:25 server sshd[26594]: Invalid user cafe from 195.189.62.29 Jul 17 21:14:25 server sshd[26594]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:25 server sshd[26595]: input_userauth_request: invalid user cafe Jul 17 21:14:25 server sshd[26595]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:28 server sshd[26596]: Invalid user station from 195.189.62.29 Jul 17 21:14:28 server sshd[26596]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:28 server sshd[26597]: input_userauth_request: invalid user station Jul 17 21:14:29 server sshd[26597]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:32 server sshd[26598]: Invalid user play from 195.189.62.29 Jul 17 21:14:32 server sshd[26598]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:32 server sshd[26599]: input_userauth_request: invalid user play Jul 17 21:14:32 server sshd[26599]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:33 server sshd[26603]: Connection closed by 127.0.0.1 Jul 17 21:14:35 server sshd[26604]: Invalid user open from 195.189.62.29 Jul 17 21:14:35 server sshd[26604]: Excess permission or bad ownership on file /var/log/btmp Jul 17 21:14:35 server sshd[26605]: input_userauth_request: invalid user open Jul 17 21:14:36 server sshd[26605]: Received disconnect from 195.189.62.29: 11: Bye Bye Jul 17 21:14:39 server sshd[26607]: Invalid user dulap from 195.189.62.29 Jul 17 21:14:39 server sshd[26607]: Excess permission or bad ownership on file /var/log/btmp
我只想知道我是如何得到这些请求，因为我使用公共密钥login。
这些尝试从我的服务器或外部networking，在哪个端口
他们是来自乌克兰的login尝试。 仅仅因为你拥有公钥并不意味着人们不能尝试login，他们可以尝试失败。 假设你不接受密码，公钥/私钥只会让它更难破解。 如果你想避免机器人的日志垃圾邮件整天砸在你的服务器上移动SSH到一个非标准的端口（如8022，或28022），你会看到less自动login尝试。 另外我会检查您的btmp文件的权限，他们似乎是不正确的。
/var/log/btmp应该由root用户拥有，并拥有权限600，所以chown root:utmp /var/log/btmp && chmod 600 /var/log/btmp应该可以解决这个问题。 是的，它并不意味着被vi读取，你可以使用last命令如last -f /var/log/btmp来读取它。
至于把ssh端口从22改成你需要编辑/etc/ssh/sshd_config并添加一个Port 8022这样的Port 22如果存在Port 22则注释掉，然后重新启动ssh。 另外请确保如果您正在使用防火墙，则在断开连接之前允许使用新的端口，这样您就不会自行locking。