218.92.1.131
178.118.158.229
14.33.133.188
177.79.4.173
177.79.8.25
179.242.37.9
218.92.1.131
특정 ip 에서 계속 로그인 시도를 하네요.
Jun 11 19:44:14 localhost sshd[32108]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:44:57 localhost sshd[3928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:44:57 localhost sshd[3928]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:44:59 localhost sshd[3928]: Failed password for root from 218.92.1.131 port 49285 ssh2
Jun 11 19:44:59 localhost sshd[3928]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:45:01 localhost sshd[3928]: Failed password for root from 218.92.1.131 port 49285 ssh2
Jun 11 19:45:01 localhost sshd[3928]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:45:03 localhost sshd[3928]: Failed password for root from 218.92.1.131 port 49285 ssh2
Jun 11 19:45:03 localhost sshd[3928]: Received disconnect from 218.92.1.131 port 49285:11: [preauth]
Jun 11 19:45:03 localhost sshd[3928]: Disconnected from 218.92.1.131 port 49285 [preauth]
Jun 11 19:45:03 localhost sshd[3928]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:46:10 localhost sshd[4021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:46:10 localhost sshd[4021]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:46:12 localhost sshd[4021]: Failed password for root from 218.92.1.131 port 54866 ssh2
Jun 11 19:46:12 localhost sshd[4021]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:46:14 localhost sshd[4021]: Failed password for root from 218.92.1.131 port 54866 ssh2
Jun 11 19:46:14 localhost sshd[4021]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:46:16 localhost sshd[4021]: Failed password for root from 218.92.1.131 port 54866 ssh2
Jun 11 19:46:17 localhost sshd[4021]: Received disconnect from 218.92.1.131 port 54866:11: [preauth]
Jun 11 19:46:17 localhost sshd[4021]: Disconnected from 218.92.1.131 port 54866 [preauth]
Jun 11 19:46:17 localhost sshd[4021]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:47:08 localhost sshd[4207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:47:08 localhost sshd[4207]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:47:10 localhost sshd[4207]: Failed password for root from 218.92.1.131 port 29967 ssh2
Jun 11 19:47:11 localhost sshd[4207]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:47:13 localhost sshd[4207]: Failed password for root from 218.92.1.131 port 29967 ssh2
Jun 11 19:47:13 localhost sshd[4207]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:47:15 localhost sshd[4207]: Failed password for root from 218.92.1.131 port 29967 ssh2
Jun 11 19:47:15 localhost sshd[4207]: Received disconnect from 218.92.1.131 port 29967:11: [preauth]
Jun 11 19:47:15 localhost sshd[4207]: Disconnected from 218.92.1.131 port 29967 [preauth]
Jun 11 19:47:15 localhost sshd[4207]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:48:14 localhost sshd[4294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:48:14 localhost sshd[4294]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:48:16 localhost sshd[4294]: Failed password for root from 218.92.1.131 port 53581 ssh2
Jun 11 19:48:16 localhost sshd[4294]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:48:18 localhost sshd[4294]: Failed password for root from 218.92.1.131 port 53581 ssh2
Jun 11 19:48:18 localhost sshd[4294]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Jun 11 19:48:20 localhost sshd[4294]: Failed password for root from 218.92.1.131 port 53581 ssh2
Jun 11 19:48:21 localhost sshd[4294]: Received disconnect from 218.92.1.131 port 53581:11: [preauth]
Jun 11 19:48:21 localhost sshd[4294]: Disconnected from 218.92.1.131 port 53581 [preauth]
Jun 11 19:48:21 localhost sshd[4294]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:48:50 localhost su: pam_unix(su-l:session): session opened for user root by pluton(uid=0)
Jun 11 19:49:10 localhost sshd[4374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.131 user=root
Jun 11 19:49:10 localhost sshd[4374]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
이거 해석좀 해 주세요.
물론 특정ip만 가능하도록 하고,
통신포트 역시 바꾸어 버리세요.
전혀 사용하지 않는 자신만의 포트로...
예를들면 본인 생일 같은 4자리 숫자로...
원격지 지정한 iptables 설정 및 ssh포트 바꾸면 보통 큰 문제 없습니다.
더 안전한걸 원하시면 컨테이너나, 내부 사설망을 박고 NAT / 포트 포워딩같은거 하면 시도 로그조차 거의 안 생겨서 깔끔하긴 합니다...
구글 OTP를 설정해두는 것도 좋습니다.
아니면 패스워드 대신 "인증서키"값으로만 로그인 되도록 바꾸는 것도 방법이고..
22번 포트를 다른 걸로 아예 바꾸는 것도 방법입니다.