Mysticbinary

只有通过概念的劳作才能获得真实的思想

secure 审计暴力登陆 hids

文件路径

cd /var/log
-rw-------   1 root   root    1200063 Aug 10 20:04 secure

做应急响应,或者做脚本监控的时候,都可以参考如下特征

...
Aug 10 09:45:48 Xx-01 sshd[3835443]: Invalid user test from x.x.x.x port 38648
Aug 10 09:45:48 Xx-01 sshd[3835443]: input_userauth_request: invalid user test [preauth]
Aug 10 09:45:48 Xx-01 sshd[3835443]: pam_unix(sshd:auth): check pass; user unknown
Aug 10 09:45:48 Xx-01 sshd[3835443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x
Aug 10 09:45:49 Xx-01 sshd[3835443]: Failed password for invalid user test from x.x.x.x port 38648 ssh2
Aug 10 09:45:49 Xx-01 sshd[3835443]: Connection closed by x.x.x.x port 38648 [preauth]

# 这一段为一组,都是描述来源x.x.x.x的ip、端口使用test 用户名登陆失败 
Aug 10 09:46:14 Xx-01 sshd[3835624]: Invalid user test from x.x.x.x port 56747
Aug 10 09:46:14 Xx-01 sshd[3835624]: input_userauth_request: invalid user test [preauth]
Aug 10 09:46:14 Xx-01 sshd[3835624]: pam_unix(sshd:auth): check pass; user unknown  # pam_unix  传统密码验证模块
Aug 10 09:46:14 Xx-01 sshd[3835624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x  # pam_unix  传统密码验证模块
Aug 10 09:46:16 Xx-01 sshd[3835624]: Failed password for invalid user test from x.x.x.x port 56747 ssh2 # 密码错误
Aug 10 09:46:16 Xx-01 sshd[3835624]: Connection closed by x.x.x.x port 56747 [preauth] # 连接关闭
...

这篇文章对你有帮助吗?作为一名程序工程师,在评论区留下你的困惑或你的见解,大家一起来交流吧!
微信公众号: Mysticbinary
Github:https://github.com/Mysticbinary
本文版权归作者所有,欢迎转载,但未经作者同意请保留此段声明,请在文章页面明显位置给出原文链接
声明:本文章仅限于讨论网络安全技术,请勿用作任何非法用途,否则后果自负,本人和博客园不承担任何责任!

posted on 2020-08-10 20:13  Mysticbinary  阅读(203)  评论(0编辑  收藏  举报

导航