阿里云登录日志有未知 ip，很奇怪

[diveIntoWork]

root@master:~# last

root pts/0 124.16.137.xxx Sun Apr 8 15:21 still logged in

root pts/0 180.76.50.99 Wed Apr 4 10:13 - 10:13 (00:00)

root pts/2 180.76.50.99 Wed Apr 4 10:01 - 10:01 (00:00)

root pts/2 180.76.50.99 Wed Apr 4 09:42 - 09:42 (00:00)

root pts/1 124.16.137.xxx Wed Apr 4 09:34 - 12:09 (02:35)

root pts/1 180.76.50.99 Wed Apr 4 09:24 - 09:24 (00:00)

root pts/1 180.76.50.99 Wed Apr 4 09:21 - 09:21 (00:00)

root pts/1 180.76.50.99 Wed Apr 4 09:18 - 09:18 (00:00)

除了我自己的本机 ip 外，一直有个 180.76.50.99 的 ip 登录，而且也是秒登秒下，查了一下是海淀百度的 ip。检查了一下集群，crontab 里也没有异常，不过最近阿里云倒经常发短信提醒主机被扫描。 有大神分析一波吗？

[udev]

阿里云盾卸载了吗？

[diveIntoWork]

@udev 好像没装这项服务

[harwck]

密钥登陆搞了吗？密码登录关了吗？

[mokeyjay]

@diveIntoWork #2 这是预装的

[niubee1]

很显然有人在企图搞你, follow #3 楼的步骤加固一下

[diveIntoWork]

@harwck ssh 配了免密登录，密码登录没有关

[diveIntoWork]

@niubee1 我觉得被扫描挺正常，需不需要把 sshd 的 22 端口换一下？或者无视，暴力破解应该也没那么容易

[hcymk2]

http://180.76.50.99:8888/login
这什么鬼？

[yexm0]

@hcymk2 百度在搞黑产吧

[f2f2f]

@yexm0 这网址进去明显是装的宝塔面板然后换了标题……

[diveIntoWork]

@hcymk2 wtf，有点意思了，为什么查出来是百度的 ip 呢

[fengyj]

@f2f2f 还真是，点下忘了密码，跳转到 bt.cn😂🤣

[wekw]

确认过日志，你被黑了，重装吧

[Tink]

被黑了

[labxx]

被人搞了

[wspsxing]

我 TM 6 号才上车，禁止了 root 登录，而且根本没有 admin。。太可怕
```sh
~> sudo lastb
admin ssh:notty 113.172.191.116 Sun Apr 8 05:48 - 05:48 (00:00)
admin ssh:notty 113.172.191.116 Sun Apr 8 05:48 - 05:48 (00:00)
admin ssh:notty 123.118.206.182 Sun Apr 8 05:48 - 05:48 (00:00)
admin ssh:notty 123.118.206.182 Sun Apr 8 05:48 - 05:48 (00:00)
admin ssh:notty 171.5.36.149 Sun Apr 8 05:47 - 05:47 (00:00)
admin ssh:notty 171.5.36.149 Sun Apr 8 05:47 - 05:47 (00:00)
admin ssh:notty 163.172.190.197 Sat Apr 7 19:59 - 19:59 (00:00)
admin ssh:notty 163.172.190.197 Sat Apr 7 19:59 - 19:59 (00:00)
root ssh:notty 163.172.190.197 Sat Apr 7 19:59 - 19:59 (00:00)
admin ssh:notty 190.167.110.213 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 190.167.110.213 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 14.161.42.248 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 14.161.42.248 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 116.101.151.71 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 116.101.151.71 Sat Apr 7 17:31 - 17:31 (00:00)
admin ssh:notty 202.125.167.187 Sat Apr 7 04:59 - 04:59 (00:00)
admin ssh:notty 202.125.167.187 Sat Apr 7 04:59 - 04:59 (00:00)
root ssh:notty 202.125.167.187 Sat Apr 7 04:59 - 04:59 (00:00)
admin ssh:notty 217.182.252.114 Sat Apr 7 01:18 - 01:18 (00:00)
admin ssh:notty 217.182.252.114 Sat Apr 7 01:18 - 01:18 (00:00)
```

[projectzoo]

吓得我赶紧看一下我的机器去。

[king2014]

第一件事情更换 ssh 端口，第二件事情密钥登录，第三件事情关闭密码登录，第四件事情禁止 root 登录，这个流程走一遍试试

[opengps]

换非常规端口是必然要做的，一大堆自动扫描器，扫到后就开始暴力破解