如果你对安全问题还有犹豫,抱有“我这个小站没人理”的想法,那么打开 /var/log/secure 看看有多少 IP 多少次企图登录你的服务器?
刚开通的一个 VPS 还来不及用,过几天打开 /var/log/secure 一看,发现 n 个 IP 访问了 n 次。一个 IP 地址为 213.115.115.113 的机器1天内2600多次猜测用户名/密码企图登录。
这是 log 文件片段:
复制代码代码如下:
Jun 28 13:49:23 blog sshd[3462]: Received disconnect from 213.115.115.113: 11: Bye Bye
Jun 28 13:49:24 blog sshd[3695]: Invalid user radu from 213.115.115.113
Jun 28 13:49:24 blog sshd[3703]: input_userauth_request: invalid user radu
Jun 28 13:49:24 blog sshd[3695]: pam_unix(sshd:auth): check pass; user unknown
Jun 28 13:49:24 blog sshd[3695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=static-213-115-115-113.sme.bredbandsbolaget.se
Jun 28 13:49:26 blog sshd[3695]: Failed password for invalid user radu from 213.115.115.113 port 51310 ssh2
Jun 28 13:49:26 blog sshd[3703]: Received disconnect from 213.115.115.113: 11: Bye Bye
Jun 28 13:49:27 blog sshd[3910]: Invalid user raducu from 213.115.115.113
Jun 28 13:49:27 blog sshd[3921]: input_userauth_request: invalid user raducu
Jun 28 13:49:27 blog sshd[3910]: pam_unix(sshd:auth): check pass; user unknown
Jun 28 13:49:27 blog sshd[3910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=static-213-115-115-113.sme.bredbandsbolaget.se
Jun 28 13:49:30 blog sshd[3910]: Failed password for invalid user raducu from 213.115.115.113 port 52740 ssh2
Jun 28 13:49:30 blog sshd[3921]: Received disconnect from 213.115.115.113: 11: Bye Bye
Jun 28 13:49:31 blog sshd[5280]: Invalid user raul from 213.115.115.113
Jun 28 13:49:31 blog sshd[5293]: input_userauth_request: invalid user raul
Jun 28 13:49:31 blog sshd[5280]: pam_unix(sshd:auth): check pass; user unknown
Jun 28 13:49:31 blog sshd[5280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=static-213-115-115-113.sme.bredbandsbolaget.se
Jun 28 13:49:33 blog sshd[5280]: Failed password for invalid user raul from 213.115.115.113 port 54742 ssh2
Jun 28 13:49:34 blog sshd[5293]: Received disconnect from 213.115.115.113: 11: Bye Bye
Jun 28 13:49:35 blog sshd[5540]: Invalid user robert from 213.115.115.113
Jun 28 13:49:35 blog sshd[5570]: input_userauth_request: invalid user robert
Jun 28 13:49:35 blog sshd[5540]: pam_unix(sshd:auth): check pass; user unknown
Jun 28 13:49:35 blog sshd[5540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=static-213-115-115-113.sme.bredbandsbolaget.se
Jun 28 13:49:37 blog sshd[5540]: Failed password for invalid user robert from 213.115.115.113 port 56483 ssh2
所以安全问题不可小觑。有2种方式可以增加 root 登录 VPS 时的安全性,这2种方式绑在一起用最好,如果怕麻烦的话至少要用其中的1种。
禁止 root 直接登录 sshd
登录VPS时必须用一个普通帐号登录,然后 su 成 root。可以修改 /etc/ssh/sshd_config 来禁止 root 直接登录:
PermitRootLogin no