Linux 安全信息查看

 

• 终端登录情况

last

• ssh登录情况

cat /var/log/secure | grep -i "accepted password"

• 定时任务

cat /var/log/cron

•  统计尝试入侵的IP

cat /var/log/secure|awk '/Failed/{print $(NF-3)}'|sort|uniq -c|awk '{print $2"="$1;}' 

 

• 禁用IP

echo sshd:183.40.138.224:deny >> /etc/hosts.deny

 

 

crontab -e

/var/spool/cron/crontabs

 

 

• cat /var/log/secure

 正常登录退出日志

Apr 11 16:36:06 bc2 sshd[11280]: Accepted password for root from 13.111.211.40 port 54560 ssh2
Apr 11 16:36:07 bc2 sshd[11280]: pam_unix(sshd:session): session opened for user root by (uid=0)
Apr 11 16:36:07 bc2 sshd[11283]: Accepted password for root from 13.111.211.40 port 54563 ssh2
Apr 11 16:36:07 bc2 sshd[11283]: pam_unix(sshd:session): session opened for user root by (uid=0)
Apr 11 16:36:17 bc2 sshd[11280]: pam_unix(sshd:session): session closed for user root
Apr 11 16:36:17 bc2 sshd[11283]: pam_unix(sshd:session): session closed for user root

 

密码枚举日志

Apr 11 16:38:52 bc2 sshd[12063]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Apr 11 16:38:53 bc2 sshd[12063]: Failed password for root from 111.23.72.25 port 45486 ssh2
Apr 11 16:39:07 bc2 sshd[12063]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Apr 11 16:39:09 bc2 sshd[12063]: Failed password for root from 111.23.72.25 port 45486 ssh2
Apr 11 16:39:09 bc2 sshd[12063]: Connection closed by 111.23.72.25 port 45486 [preauth]
Apr 11 16:39:09 bc2 sshd[12063]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.23.72.25 user=root
Apr 11 16:39:19 bc2 sshd[7663]: pam_unix(sshd:session): session closed for user root
Apr 11 16:39:28 bc2 sshd[12351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.23.72.25 user=root
Apr 11 16:39:28 bc2 sshd[12351]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
Apr 11 16:39:30 bc2 sshd[12351]: Failed password for root from 111.23.72.25 port 45524 ssh2
Apr 11 16:39:55 bc2 sshd[12493]: refused connect from 36.153.0.228 (36.153.0.228)