ftp1 大佬有话说 :
为什么这个世界总是充满了恶意
本帖最后由 ftp1 于 2020-5-6 15:30 编辑
买了个小鸡鸡装上大便，改了ssh端口，某天用lastb看了一下，10w+次的失败登录记录，感觉到处都是抓鸡的大佬。
yc009t
实在不想配置免密登录，看了一下fail2ban感觉配置有点麻烦所以写了一个简单的shell去把所有登录本机失败的ip全部放到防火墙里面了
yc008t
分享一下给新同学
https://git.io/JfZRM
其中的port是你自己ssh的端口，谁通过这个端口访问失败都会进入reject.sh这个脚本，你运行完banips之后只需要再运行一次reject就行了，运行完记得删除reject脚本。
如果你够自信也可以直接不输出到reject直接在banips里面把这些ip block，配合crontab 2小时一次更佳
ps:用了这个脚本后，恶意访问的ip发现了1w+，lastb的记录还是很多，黑产大佬的ip真多啊
驴总 大佬有话说 :
因为资源有限,要想尽各种办法去夺取
ansheng 大佬有话说 :
看来适合局域网
ZHT5178 大佬有话说 :
端口这么好猜到的么？
https://cdn.jsdelivr.net/gh/hishis/forum-grandmaster-for-discuz/public/images/patch.gif
你说的都对 大佬有话说 :
黑产大佬全网自动化抓鸡，你只是其中之一
merloat 大佬有话说 :
僵尸网络太可怕了，它一直存在，只能想办法慢慢缓解yc022t，但是却无法根除yc014t
yugan300 大佬有话说 :
换个端口吧。
LuVer 大佬有话说 :
因为太善良
我能做两个小时 大佬有话说 :
本帖最后由 我能做两个小时 于 2020-5-6 15:30 编辑
不看不知道……一看就吓尿，每秒钟要访问几次，难怪卡的很，光记录信息就展示了两分钟，操
training ssh:notty 46.219.116.22 Fri May1 07:32 – 07:32(00:00)
training ssh:notty 46.219.116.22 Fri May1 07:32 – 07:32(00:00)
bh ssh:notty 193.112.127.245Fri May1 07:25 – 07:25(00:00)
bh ssh:notty 193.112.127.245Fri May1 07:25 – 07:25(00:00)
qwert ssh:notty 46.219.116.22 Fri May1 07:24 – 07:24(00:00)
qwert ssh:notty 46.219.116.22 Fri May1 07:24 – 07:24(00:00)
root ssh:notty 218.92.0.208 Fri May1 07:23 – 07:23(00:00)
root ssh:notty 218.92.0.208 Fri May1 07:23 – 07:23(00:00)
root ssh:notty 218.92.0.208 Fri May1 07:23 – 07:23(00:00)
defaultssh:notty 187.22.154.41 Fri May1 07:17 – 07:17(00:00)
defaultssh:notty 187.22.154.41 Fri May1 07:17 – 07:17(00:00)
aishwary ssh:notty 46.219.116.22 Fri May1 07:16 – 07:16(00:00)
aishwary ssh:notty 46.219.116.22 Fri May1 07:16 – 07:16(00:00)
root ssh:notty 46.219.116.22 Fri May1 07:13 – 07:13(00:00)
cod4 ssh:notty 46.219.116.22 Fri May1 07:09 – 07:09(00:00)
cod4 ssh:notty 46.219.116.22 Fri May1 07:09 – 07:09(00:00)
itg ssh:notty 46.219.116.22 Fri May1 07:05 – 07:05(00:00)
itg ssh:notty 46.219.116.22 Fri May1 07:05 – 07:05(00:00)
camera ssh:notty 46.219.116.22 Fri May1 07:01 – 07:01(00:00)
camera ssh:notty 46.219.116.22 Fri May1 07:01 – 07:01(00:00)
root ssh:notty 46.219.116.22 Fri May1 06:57 – 06:57(00:00)
boller ssh:notty 46.219.116.22 Fri May1 06:53 – 06:53(00:00)
boller ssh:notty 46.219.116.22 Fri May1 06:53 – 06:53(00:00)
admin ssh:notty 193.112.127.245Fri May1 06:53 – 06:53(00:00)
admin ssh:notty 193.112.127.245Fri May1 06:53 – 06:53(00:00)
sammy ssh:notty 46.219.116.22 Fri May1 06:50 – 06:50(00:00)
sammy ssh:notty 46.219.116.22 Fri May1 06:50 – 06:50(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:44 – 06:44(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:44 – 06:44(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:43 – 06:43(00:00)
root ssh:notty 187.22.154.41 Fri May1 06:43 – 06:43(00:00)
vt ssh:notty 46.219.116.22 Fri May1 06:42 – 06:42(00:00)
vt ssh:notty 46.219.116.22 Fri May1 06:42 – 06:42(00:00)
root ssh:notty 193.112.127.245Fri May1 06:41 – 06:41(00:00)
social ssh:notty 187.22.154.41 Fri May1 06:38 – 06:38(00:00)
social ssh:notty 187.22.154.41 Fri May1 06:38 – 06:38(00:00)
root ssh:notty 46.219.116.22 Fri May1 06:38 – 06:38(00:00)
root ssh:notty 46.219.116.22 Fri May1 06:35 – 06:35(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:32 – 06:32(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:32 – 06:32(00:00)
root ssh:notty 218.92.0.208 Fri May1 06:32 – 06:32(00:00)
heera ssh:notty 46.219.116.22 Fri May1 06:31 – 06:31(00:00)
heera ssh:notty 46.219.116.22 Fri May1 06:31 – 06:31(00:00)
root ssh:notty 46.219.116.22 Fri May1 06:27 – 06:27(00:00)
air ssh:notty 193.112.127.245Fri May1 06:25 – 06:25(00:00)
air ssh:notty 193.112.127.245Fri May1 06:25 – 06:25(00:00)
西北老汉 大佬有话说 :
密钥不麻烦吧:lol