这是 DDoS、黑客攻击还是其他什么？

Question

我早些时候通过 SSH 连接到我的家庭服务器，因为响应 HTTP 请求需要很长时间。我注意到 shell 提示符也运行缓慢。所以我输入了top，并看到了几个sshd使用大量 CPU 时间的实例。我检查了 auth.log，这是我看到的：

Jul 16 14:31:56 server sshd[5799]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:31:56 server sshd[5799]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:31:56 server sshd[5799]: input_userauth_request: invalid user root [preauth]
Jul 16 14:31:56 server sshd[5799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:31:59 server sshd[5799]: Failed password for invalid user root from 198.136.57.92 port 54672 ssh2
Jul 16 14:31:59 server sshd[5799]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]
Jul 16 14:32:00 server sshd[5802]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:32:00 server sshd[5802]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:32:00 server sshd[5802]: input_userauth_request: invalid user root [preauth]
Jul 16 14:32:00 server sshd[5802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:32:01 server sshd[5802]: Failed password for invalid user root from 198.136.57.92 port 56112 ssh2
Jul 16 14:32:02 server sshd[5802]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]
Jul 16 14:32:04 server sshd[5805]: reverse mapping checking getaddrinfo for 198-136-57-92.static.lvnoc.com [198.136.57.92] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul 16 14:32:04 server sshd[5805]: User root from 198.136.57.92 not allowed because none of user's groups are listed in AllowGroups
Jul 16 14:32:04 server sshd[5805]: input_userauth_request: invalid user root [preauth]
Jul 16 14:32:04 server sshd[5805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.136.57.92  user=root
Jul 16 14:32:06 server sshd[5805]: Failed password for invalid user root from 198.136.57.92 port 57176 ssh2
Jul 16 14:32:06 server sshd[5805]: Received disconnect from 198.136.57.92: 11: Bye Bye [preauth]

注意左侧的时间戳以查看它的频率。根据日志，在我看到之前，它已经发生了大约半个小时。不用说，我在 中屏蔽了他们的 IP ( 198.136.57.92) hosts.deny，但我想知道这里到底发生了什么。这只是拒绝服务攻击，还是POSSIBLE BREAK-IN ATTEMPT?

Answer 1

好吧，这POSSIBLE BREAK-IN ATTEMPT意味着尝试连接的 IP 地址的反向 DNS 区域设置不正确；正向 DNS 记录与反向 DNS 记录不匹配。

看起来有人试图对您的服务器进行暴力破解以使用 SSH。

我怀疑这是使用 SSH 的 DDoS。