linux - AWS Linux : illegal intrusion attempts against remote hosts on the Internet. 预防方法？

Question

我启动了一个 Linux 实例并执行了以下操作。

1. 仅开放 22、80 和 8080 端口作为入站规则，向“所有地方”开放
2. 只有 git、ruby、ruby-dev、apache 和 youtrack 是从其原始来源或使用“yum install”命令安装的。
3. 允许对连接进行 SSH 密码验证。
4. 我创建了一些用户。

但是，我们收到了以下邮件。

Dear Amazon EC2 Customer,

We've received a report that your instance(s):

Instance Id: i-******
IP Address: 52.33.***.***



has been making illegal intrusion attempts against remote hosts on the Internet; check the information provided below by the abuse reporter.

Host Intrusion is specifically forbidden in our User Agreement: http://aws.amazon.com/agreement/

Please immediately restrict the flow of traffic from your instances(s) to cease disruption to other networks and reply this email to send your reply of action to the original abuse reporter. This will activate a flag in our ticketing system, letting us know that you have acknowledged receipt of this email.

It's possible that your environment has been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured. The link http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233
provides some suggestions for securing your instances.

Case number: ************-1

Additional abuse report information provided by original abuse reporter:
* Destination IPs: 
* Destination Ports: 
* Destination URLs: 
* Abuse Time: Fri Nov 13 13:28:00 UTC 2015
* Log Extract: 
<<<
2015-11-13 05:28:10.279 52.33.***.*** 40806 ***.***.193.0 22 ....S. 6 3 
2015-11-13 05:28:17.495 52.33.***.*** 40806 ***.***.193.0 22 ....S. 6 1 
2015-11-13 05:28:20.018 52.33.***.*** 49968 ***.***.193.1 22 ....S. 6 3 
2015-11-13 05:28:27.378 52.33.***.*** 49968 ***.***.193.1 22 ....S. 6 1 
2015-11-13 05:28:29.998 52.33.***.*** 36185 ***.***.193.2 22 ....S. 6 1 
2015-11-13 05:28:30.999 52.33.***.*** 36185 ***.***.193.2 22 ....S. 6 1 
2015-11-13 05:28:32.999 52.33.***.*** 36185 ***.***.193.2 22 ....S. 6 1 
2015-11-13 05:28:36.999 52.33.***.*** 36185 ***.***.193.2 22 ....S. 6 1 
2015-11-13 05:28:40.246 52.33.***.*** 59503 ***.***.193.3 22 ....S. 6 2 
2015-11-13 05:28:43.471 52.33.***.*** 59503 ***.***.193.3 22 ....S. 6 1 
2015-11-13 05:28:47.517 52.33.***.*** 59503 ***.***.193.3 22 ....S. 6 1 
2015-11-13 05:28:50.070 52.33.***.*** 48731 ***.***.193.4 22 ....S. 6 3 
2015-11-13 05:28:57.589 52.33.***.*** 48731 ***.***.193.4 22 ....S. 6 1 
2015-11-13 05:28:59.967 52.33.***.*** 58537 ***.***.193.5 22 .A.RS. 6 3 
2015-11-13 05:28:59.921 52.33.***.*** 58647 ***.***.193.5 22 .APRS. 6 12 
2015-11-13 05:29:01.999 52.33.***.*** 58647 ***.***.193.5 22 ...R.. 6 1 
2015-11-13 05:29:01.968 52.33.***.*** 59568 ***.***.193.5 22 .APRS. 6 12 
2015-11-13 05:29:03.970 52.33.***.*** 59568 ***.***.193.5 22 ...R.. 6 1 
2015-11-13 05:29:04.007 52.33.***.*** 60527 ***.***.193.5 22 .APRS. 6 12 
2015-11-13 05:29:05.999 52.33.***.*** 60527 ***.***.193.5 22 ...R.. 6 1 

1. 我们无法选择将端口限制为特定 IP 地址。

2. 如何查看 SSH 端口 22 上的流量日志？

   你有什么建议？我该怎么办？

由于它是一个新主机，而且我的电脑上没有恶意软件，所以我不相信它已被泄露/遭到黑客攻击？

有人如何破解我的服务器？这可能是错误发送的滥用报告吗？

谢谢，

Answer 1

您的实例可能已被包含。由于打开实例进行密码身份验证，或者安装了存在安全问题的应用程序，导致攻击者可以在您的实例上安装恶意软件。

新实例很快就会受到威胁。一直有人在扫描 IP 地址是否存在漏洞。

为了保证 SSH 的安全，您应该仅使用 key 身份验证，如果可能的话，对某些 IP 地址进行白名单访问。