sshd 日志充满“未收到来自”的识别字符串

Question

Mar  2 02:34:02 freetalker3 sshd[28436]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:08 freetalker3 sshd[28439]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:13 freetalker3 sshd[28442]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:19 freetalker3 sshd[28445]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:24 freetalker3 sshd[28448]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:30 freetalker3 sshd[28451]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:35 freetalker3 sshd[28454]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:41 freetalker3 sshd[28457]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:46 freetalker3 sshd[28460]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:52 freetalker3 sshd[28463]: Did not receive identification string from 211.110.33.50
Mar  2 02:34:57 freetalker3 sshd[28466]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:03 freetalker3 sshd[28469]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:08 freetalker3 sshd[28472]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:14 freetalker3 sshd[28475]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:20 freetalker3 sshd[28478]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:25 freetalker3 sshd[28481]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:31 freetalker3 sshd[28484]: Did not receive identification string from 211.110.33.50
Mar  2 02:35:36 freetalker3 sshd[28488]: Did not receive identification string from 211.110.33.50

我的 /var/log/auth.log 充满了这些消息，每 6 秒发送一次垃圾邮件。我的服务器在 vps 上，ip 似乎是一个内部 ip。这个问题的原因是什么？

Answer 1

实际上，这是来自我的托管服务提供商 - 他们每 6 秒向我的 VPS 发送一次垃圾邮件，以在他们的 Web 控制台上显示我的服务器状态。如果我的 sshd 回答了它们，我的服务器将显示为活动状态。

我刚刚安装了 OpenVPN 并且只允许通过它使用 SSH - 因此，根据我的提供商的说法，我的服务器拥有 100% 的停机时间。

Answer 2

这很可能是来自通信的 keepalive（验证服务器正在响应）。设备。

Answer 3

当有人试图访问它但没有完成这些步骤时，SSH 会抛出此类消息。例如，如果 NMS 正在检查端口 ssh 22 是否已启动，它只会尝试在端口 22 上连接，如果连接成功，它将挂断，在这种情况下，SSH 报告相同。

所以这是因为SSH端口扫描。

Answer 4

一些恶棍（惊讶！）正在敲击 ssh，试图找到可以让他们进入系统的用户名/密码组合。可能是某个僵尸网络对谁知道还有多少毫无戒心的受害者做了同样的事情。

安装诸如fail2ban或DenyHosts之类的东西（其中一些应该适用于任何Linux发行版），或者设置本地防火墙以限制SSH连接尝试。更改 SSH 端口会使愚蠢的暴力尝试失败，但也会使合法使用失败。