El mié, 23 ago 2023 a las 9:54, Roberto C. Sánchez (<robe...@debian.org>) escribió:
> > > En auth.log veo una gran cantidad de mensajes parecido a esto: > > 2023-08-23T09:48:32.417117-04:00 build01 sshd[3701736]: User root from > 103.81.86.208 not allow > ed because not listed in AllowUsers > 2023-08-23T09:48:32.685843-04:00 build01 sshd[3701736]: Received disconnect > from 103.81.86.208 > port 42522:11: Bye Bye [preauth] > 2023-08-23T09:48:32.686043-04:00 build01 sshd[3701736]: Disconnected from > invalid user root 10 > 3.81.86.208 port 42522 [preauth] > > > auth,authpriv.* /var/log/auth.log > > > Y tengo lo mismo en /etc/rsyslog.conf. > > Tiene que haber algo de mal con tu configuración, pero nos haría falta > ver /etc/ssh/sshd_config y /etc/rsyslog.conf (o cualquier cosa que > tienes debajo /etc/rsyslog.d/) para poder prestarte mejor ayuda. > esta es la parte de configuracion de mi sshd_config , fuera de eso no tengo una configuracion especial ni nada. Include /etc/ssh/sshd_config.d/*.conf #Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH #LogLevel INFO LogLevel VERBOSE # Authentication: #LoginGraceTime 2m PermitRootLogin yes #StrictModes yes MaxAuthTries 3 #MaxSessions 10 #PubkeyAuthentication yes # Expect .ssh/authorized_keys2 to be disregarded by default in future. #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) KbdInteractiveAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the KbdInteractiveAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via KbdInteractiveAuthentication may bypass # the setting of "PermitRootLogin prohibit-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and KbdInteractiveAuthentication to 'no'. UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no #PidFile /run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Allow client to pass locale environment variables AcceptEnv LANG LC_* # override default of no subsystems Subsystem sftp /usr/lib/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server lo interesante es que si hago un journalctl -u ssh , veo cantidad de ataques conexiones a mi ssh , pero no lo registra el auth.log Aug 23 09:16:30 relay.srv sshd[18068]: error: kex_exchange_identification: Connection closed by remote ho> Aug 23 10:29:18 relay.srv sshd[19783]: fatal: Timeout before authentication for 42.51.227.67 port 25073 Aug 23 10:47:21 relay.srv sshd[20293]: error: kex_exchange_identification: Connection closed by remote ho> Aug 23 11:37:39 relay.srv sshd[21528]: error: kex_exchange_identification: banner line contains invalid c> Aug 23 11:37:51 relay.srv sshd[21542]: fatal: userauth_pubkey: parse publickey packet: incomplete message> Aug 23 12:29:23 relay.srv sshd[22814]: fatal: Timeout before authentication for 178.74.61.156 port 57086 Aug 23 13:07:27 relay.srv sshd[23768]: error: maximum authentication attempts exceeded for root from 43.1> Aug 23 13:07:38 relay.srv sshd[23780]: error: maximum authentication attempts exceeded for root from 43.1> Aug 23 15:21:28 relay.srv sshd[27144]: fatal: Timeout before authentication for 42.225.45.222 port 46344 Aug 23 15:23:44 relay.srv sshd[27240]: fatal: Timeout before authentication for 187.73.238.82 port 9190 saludos -- rickygm http://gnuforever.homelinux.com
