|
Advance Member
|
問個 SSH 安全管理問題
下面是我的 SSH log 資料
Users logging in through sshd:
root:
1.2.3.4 (1-2-3-4.HINET-IP.hinet.net): 10 times
2.2.3.4: 4 times
10.10.10.6 (PC): 1 time
3.2.3.4 (company.com.tw): 1 time
Refused incoming connections:
119.10.27.233 (119.10.27.233): 1 Time(s)
122.225.109.103 (122.225.109.103): 3 Time(s)
122.225.109.117 (122.225.109.117): 3 Time(s)
122.225.109.122 (122.225.109.122): 3 Time(s)
122.225.109.123 (122.225.109.123): 3 Time(s)
122.225.109.203 (122.225.109.203): 3 Time(s)
122.225.109.205 (122.225.109.205): 3 Time(s)
122.225.109.218 (122.225.109.218): 3 Time(s)
122.225.109.220 (122.225.109.220): 3 Time(s)
183.110.253.233 (183.110.253.233): 1 Time(s)
200.9.104.42 (200.9.104.42): 1 Time(s)
211.138.30.174 (211.138.30.174): 1 Time(s)
219.136.249.247 (219.136.249.247): 2 Time(s)
221.133.0.17 (221.133.0.17): 3 Time(s)
223.4.82.17 (223.4.82.17): 1 Time(s)
61.174.50.163 (61.174.50.163): 3 Time(s)
61.174.50.165 (61.174.50.165): 3 Time(s)
61.174.50.213 (61.174.50.213): 3 Time(s)
61.174.50.225 (61.174.50.225): 3 Time(s)
61.174.50.235 (61.174.50.235): 3 Time(s)
61.174.51.214 (61.174.51.214): 3 Time(s)
61.174.51.215 (61.174.51.215): 3 Time(s)
SFTP subsystem requests: 11 Time(s)
---------------------- SSHD End -------------------------
1.2.3.4~3.2.3.4 & 10.10.10.6 都是我 deny 除外的IP，所以可以用 SSH 登錄，但是下面被 Refused的 IP，根本不在我 deny的允許範圍中，怎麼會還有人可以測三次。
難道有特別的封包可以將IP變更為deny 規則裏面允許的IP嗎? 那它又怎麼知道我deny規裏面的IP是設什麼?
P.S.只能測三次的原因是我安裝了fail2ban，設定只能測三次，超過三次就把它ban掉。
我有試過 deny的規則，確認過非允許的IP是無法登錄SSH，而allow 我沒有設定任何規則。
|