2005/Aug/16

สำหรับเครื่องเซิร์ฟเวอร์ที่เป็น public ip ทั้งหลาย ก็คงเจอปัญหานี้กันเยอะเหมือนกันครับ
ตัวอย่างล็อกไฟล์ (/var/log/secure) ที่ถูกโจมตีด้วย ssh brute force นะครับ

Jun 23 07:22:39 campus sshd[60775]: Failed password for root from 212.160.184.82 port 38212 ssh2
Jun 23 07:22:42 campus sshd[60777]: Failed password for root from 212.160.184.82 port 38626 ssh2
Jun 23 07:22:46 campus sshd[60779]: Failed password for root from 212.160.184.82 port 39056 ssh2
Jun 23 07:22:50 campus sshd[60781]: Failed password for root from 212.160.184.82 port 39348 ssh2
Jun 23 07:22:54 campus sshd[60783]: Failed password for root from 212.160.184.82 port 39621 ssh2
Jun 23 07:22:58 campus sshd[60785]: Illegal user johnny from 212.160.184.82
Jun 23 07:23:01 campus sshd[60787]: Illegal user johnny from 212.160.184.82
Jun 23 07:23:05 campus sshd[60789]: Illegal user johnny from 212.160.184.82
Jun 23 07:23:09 campus sshd[60791]: Illegal user johnny from 212.160.184.82
Jun 23 07:23:13 campus sshd[60793]: Illegal user johnny from 212.160.184.82
Jun 23 07:23:16 campus sshd[60795]: Illegal user johnny from 212.160.184.82

เราสามารถป้องกันการโจมตีด้วย iptables นะครับ

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 600 --hitcount 2 -j DROP

ปัญหาดังกล่าวก็จะหมดไปครับ

Comment

Comment:

Tweet


Every body acknowledges that today's life seems to be expensive, however we need money for various things and not every one gets enough money. Thence to get good <a href="http://goodfinance-blog.com">loan</a> and collateral loan will be good way out.
#1265 by BeardClare21 (91.212.226.143) At 2011-11-23 10:28,

I have been visiting this blogs it is help me thanks a lot for shearing this kind of information. Keep updating.thanksconfused smile
#1264 by Marketing Dissertation (116.71.50.161) At 2011-02-18 20:37,
gMje08 <a href="http://khrtqixwgelq.com/">khrtqixwgelq</a>, [url=http://yxkwlolyoenb.com/]yxkwlolyoenb[/url], [link=http://ypevlcraukny.com/]ypevlcraukny[/link], http://phyxiovyjsxm.com/
#1263 by wuhulbyqyou (173.212.206.186) At 2010-07-04 13:46,
r6mgm6 <a href="http://jsijgesgitaq.com/">jsijgesgitaq</a>, [url=http://fyjrcgovfimp.com/]fyjrcgovfimp[/url], [link=http://obvdmjoiaxoz.com/]obvdmjoiaxoz[/link], http://lpsrdmwzqjxn.com/
#1262 by sdwrpgs (91.214.45.253) At 2010-06-21 12:37,
<a href="http://djhuzgacukfkmoe.com">dfmogacvwvsixcq</a> http://dyvdvulkuooezxm.com [url=http://swglqrwrwpbmzuh.com]dmcghvihjcinvst[/url]
#1261 by ufvljhhjns (94.102.52.87) At 2010-06-14 02:32,
Very nice site!
#1260 by uiuwrpyy (217.20.174.68) At 2009-10-08 21:28,
Very nice site!
#1259 by iiotetpw (116.36.198.19) At 2009-10-08 20:52,
Very nice site!
#1258 by uiiyeypu (72.11.145.123) At 2009-10-08 06:17,
Very nice site!
#1257 by ooiyiepe (75.144.250.52) At 2009-10-07 22:55,
Very nice site!
#1256 by ruiwtrut (202.74.244.83) At 2009-10-07 22:16,
Very nice site!
#1255 by owiiuuiy (201.226.71.102) At 2009-10-07 17:51,
Very nice site!
#1254 by ipitiwee (222.124.199.111) At 2009-10-07 17:32,
Very nice site!
#1253 by tyyiryyw (123.140.147.109) At 2009-10-07 04:51,
Very nice site!
#1252 by erttpeow (222.124.199.111) At 2009-10-07 04:41,
Very nice site!
#1251 by trwwitpy (79.173.24.55) At 2009-10-06 13:17,
Very nice site!
#1250 by reyteopo (202.137.144.61) At 2009-10-06 10:48,
Very nice site! cheap cialis http://ypxoiea.com/qyrxoq/4.html
#1249 by reyteopo (78.139.40.66) At 2009-10-06 10:47,
Very nice site!
#1248 by etyruurp (118.107.163.5) At 2009-10-05 22:03,
Very nice site!
#1247 by yewwwwyr (211.232.143.102) At 2009-10-05 21:33,
Very nice site!
#1246 by eupoeier (79.4.102.97) At 2009-10-05 20:22,
Very nice site!
#1245 by ruuywuwr (211.115.185.53) At 2009-10-05 20:11,
Very nice site! cheap cialis http://oixapey.com/aqavrr/4.html
#1244 by ruuywuwr (195.5.39.98) At 2009-10-05 20:11,
Very nice site!
#1243 by eriiuteo (119.48.141.218) At 2009-10-05 19:58,
Very nice site!
#1242 by eperiyyy (94.136.136.140) At 2009-10-05 14:23,
Very nice site! cheap cialis http://oixapey.com/aqavrr/4.html
#1241 by eperiyyy (116.236.224.82) At 2009-10-05 14:23,
Very nice site! [url=http://oixapey.com/aqavrr/2.html]cheap cialis[/url]
#1240 by eperiyyy (202.74.244.83) At 2009-10-05 14:23,
Very nice site!
#1239 by wewyoruw (217.10.246.2) At 2009-10-05 11:02,
Very nice site!
#1238 by wtrwytpe (200.189.60.61) At 2009-10-05 10:22,
Very nice site! [url=http://oixapey.com/aqavrr/2.html]cheap cialis[/url]
#1237 by wtrwytpe (200.188.178.38) At 2009-10-05 10:22,
Very nice site!
#1236 by putyeiir (79.173.24.55) At 2009-10-05 09:52,
Very nice site!
#1235 by reyiuiii (121.14.129.79) At 2009-10-05 09:24,
Very nice site!
#1234 by utwreiuu (124.86.54.77) At 2009-10-05 01:55,
Very nice site!
#1233 by euiywtyi (194.67.160.86) At 2009-10-04 22:45,
Very nice site! [url=http://opeyixa.com/qoxaqo/2.html]cheap cialis[/url]
#1232 by euiywtyi (87.207.152.99) At 2009-10-04 22:45,
Very nice site!
#1231 by ytiureuy (121.14.129.79) At 2009-10-04 22:43,
Very nice site!
#1230 by twtwiopu (85.113.37.77) At 2009-10-04 22:34,
Very nice site!
#1229 by wieuyrww (204.185.178.250) At 2009-10-04 19:53,
Very nice site!
#1228 by yueypiey (196.12.47.102) At 2009-10-04 16:59,
Very nice site!
#1227 by ittierru (200.7.28.108) At 2009-10-04 06:56,
Very nice site!
#1226 by wpoptwuu (196.12.47.102) At 2009-10-04 02:27,
Very nice site!
#1225 by riwuuour (209.17.170.37) At 2009-10-04 01:34,
Very nice site! cheap cialis http://oieypxa.com/kyrxok/4.html
#1224 by riwuuour (82.143.150.60) At 2009-10-04 01:34,
Very nice site!
#1223 by wotpyruy (83.19.174.162) At 2009-10-04 00:11,
Very nice site!
#1222 by eyeiuwew (213.209.210.70) At 2009-10-03 22:20,
Very nice site! cheap cialis http://oieypxa.com/kyrxok/4.html
#1221 by eyeiuwew (217.173.22.72) At 2009-10-03 22:20,
Very nice site!
#1220 by yiiortty (125.165.51.151) At 2009-10-03 20:02,
Very nice site!
#1219 by teetwwor (83.146.87.113) At 2009-10-02 20:04,
Very nice site!
#1218 by wooreuut (119.252.65.101) At 2009-10-02 19:50,
Very nice site!
#1217 by ioworowy (202.108.9.6) At 2009-10-02 18:49,
Very nice site!
#1216 by iiwwprri (118.142.16.109) At 2009-10-02 15:22,