Sunt sub atac?

Salve !

scuzati ma ca iar dau buzna...dar am vazut in vi var log secure, acele listen on port 22 - cineva incearca ceva cumva ?
uitati un citat din vi var log secure al meu!

multumesc in avans pt raspunsuri!



Mar 11 21:28:34 localhost sshd[4411]: Received signal 15; terminating.
Mar 11 21:29:57 localhost sshd[3118]: Server listening on 0.0.0.0 port 22.
Mar 11 21:36:46 localhost sshd[3118]: Received signal 15; terminating.
Mar 11 21:38:06 localhost sshd[3159]: Server listening on 0.0.0.0 port 22.
Mar 11 21:38:19 localhost gdm[3284]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 11 21:48:55 localhost gdm[3284]: pam_unix(gdm:session): session closed for user root
Mar 11 21:48:56 localhost sshd[3159]: Received signal 15; terminating.
Mar 11 21:50:16 localhost sshd[3170]: Server listening on 0.0.0.0 port 22.
Mar 11 21:50:27 localhost gdm[3294]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 11 21:54:27 localhost groupadd[3514]: new group: name=fuse, GID=103
Mar 11 22:08:19 localhost gdm[3294]: pam_unix(gdm:session): session closed for user root
Mar 11 22:08:21 localhost sshd[3170]: Received signal 15; terminating.
Mar 11 22:09:42 localhost sshd[3188]: Server listening on 0.0.0.0 port 22.
Mar 11 22:09:54 localhost gdm[3313]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 11 22:24:00 localhost gdm[3313]: pam_unix(gdm:session): session closed for user root
Mar 11 22:24:02 localhost sshd[3188]: Received signal 15; terminating.
Mar 11 22:25:19 localhost sshd[3189]: Server listening on 0.0.0.0 port 22.
Mar 11 22:25:32 localhost gdm[3327]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 11 23:19:04 localhost sshd[3189]: Received signal 15; terminating.
Mar 11 23:19:07 localhost sshd[3964]: Server listening on 0.0.0.0 port 22.
Mar 11 23:19:19 localhost groupadd[3992]: new group: name=mock, GID=104
Mar 11 23:34:51 localhost gdm[3327]: pam_unix(gdm:session): session closed for user root
Mar 11 23:34:53 localhost sshd[3964]: Received signal 15; terminating.
Mar 12 02:54:42 localhost sshd[3190]: Server listening on 0.0.0.0 port 22.
Mar 12 02:54:57 localhost gdm[3328]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 12 04:45:02 localhost gdm[3328]: pam_unix(gdm:session): session closed for user root
Mar 12 04:45:04 localhost sshd[3190]: Received signal 15; terminating.
Mar 12 10:33:12 localhost sshd[3188]: Server listening on 0.0.0.0 port 22.
Mar 12 10:33:27 localhost gdm[3327]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 12 10:40:15 localhost gdm[3327]: pam_unix(gdm:session): session closed for user root
Mar 12 10:40:17 localhost sshd[3188]: Received signal 15; terminating.
Mar 12 19:40:39 localhost sshd[3191]: Server listening on 0.0.0.0 port 22.
Mar 12 19:40:52 localhost gdm[3329]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 13 02:41:49 localhost su: pam_unix(su:session): session opened for user cosmin by root(uid=0)
Mar 13 02:42:09 localhost su: pam_unix(su:session): session opened for user root by root(uid=500)
Mar 13 02:43:05 localhost useradd[6851]: new group: name=apache, GID=48
Mar 13 02:43:05 localhost useradd[6851]: new user: name=apache, UID=48, GID=48, home=/var/www, shell=/sbin/nologin
Mar 13 02:44:49 localhost useradd[6932]: new group: name=mysql, GID=27
Mar 13 02:44:49 localhost useradd[6932]: new user: name=mysql, UID=27, GID=27, home=/var/lib/mysql, shell=/bin/bash
Mar 13 02:45:13 localhost su: pam_unix(su:session): session opened for user ales by root(uid=0)
Mar 13 02:48:06 localhost su: pam_unix(su:session): session opened for user root by root(uid=500)

Mar 11 21:38:06 localhost sshd[3159]: Server listening on 0.0.0.0 port 22.
Mar 11 21:38:19 localhost gdm[3284]: pam_unix(gdm:session): session opened for user root by (uid=0)
Mar 11 21:48:55 localhost gdm[3284]: pam_unix(gdm:session): session closed for user root

Schimba parola pentru ROOT ( daca nu-i tarziu deja ), cu alta  dificil de ghicit si usor de memorat.
Cineva ti-a accesat sistemul prin SSH ( port 22 )

Edited by JJackFLASH, 13 March 2012 - 08:43.

Parca o masura de securitate era sa nu se permita autentificarea ca root prin SSH. Bine ca eu nu am server, atatea batai de cap...

am dezactivat de tot login ul prin SSH ca root ....de fapt, am dezactivat ssh de tot

ms

dreamseeker11us, on 13th March 2012, 21:04, said:

Mar 13 02:43:05 localhost useradd[6851]: new group: name=apache, GID=48
Mar 13 02:43:05 localhost useradd[6851]: new user: name=apache, UID=48, GID=48, home=/var/www, shell=/sbin/nologin
Mar 13 02:44:49 localhost useradd[6932]: new group: name=mysql, GID=27
Mar 13 02:44:49 localhost useradd[6932]: new user: name=mysql, UID=27, GID=27, home=/var/lib/mysql, shell=/bin/bash

Mai trebuie sa dezactivezi si utilizatorii apache , mysql pe care intrusul cela i-a creat.

Sfaturi:
- instalat fail2ban
- setat alt port pt ssh, preferabil nu 2222 sau ceva asemanator, alegeti ceva random.