lao1 me
搜索
首页/AI

记录家里小nas一次被网络攻击的心得

1710
  • 风过留香
    风过留香2026-08-14
    9089

    家里的小盒子是一个华为的机顶盒，运营商送的，

    刷了海纳思的系统，平常主要是pt下载，看看电影用的，

    另外定时跑一些简单的python脚本，

    下面是故事的正文。

    出去玩了几天，回来 出去玩了几天，回来后发现cpu的占用不太正常，平常一般在5%以内，现在在15%左右。

    打开终端，在top里看到多个sshd进程的cpu占用较高，

    top - 09:20:35 up 13 days, 16:33, 1 user, load average: 7.27, 6.84, 6.70

    Tasks: 211 total, 2 running, 209 sleeping, 0 stopped, 0 zombie

    %Cpu(s): 9.2 us, 5.2 sy, 0.0 ni, 85.6 id, 0.0 wa, 0.0 hi, 0.1 si, 0.0 st

    MiB Mem : 928.1 total, 138.2 free, 410.8 used, 379.1 buff/cache

    MiB Swap: 0.0 total, 0.0 free, 0.0 used. 467.6 avail Mem

    PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

    32181 root 20 0 11324 5456 4604 S 7.9 0.6 0:00.24 sshd

    32171 root 20 0 11324 5456 4604 S 5.0 0.6 0:00.22 sshd

    5873 debian-+ 20 0 219708 145096 8748 S 3.6 15.3 579:08.41 transmiss+

    32266 root 20 0 9220 4684 4092 S 1.7 0.5 0:00.05 sshd

    2136 message+ 20 0 6640 3652 2608 S 1.3 0.4 78:02.23 dbus-daem+

    25187 www-data 20 0 203428 17612 13708 S 1.3 1.9 0:01.63 php-fpm7.4

    32147 root 20 0 9860 2420 2076 R 1.3 0.3 0:00.15 top

    32160 sshd 20 0 9220 2956 2336 S 1.3 0.3 0:00.04 sshd

    32173 sshd 20 0 9220 2968 2352 S 1.3 0.3 0:00.04 sshd

    32182 sshd 20 0 9220 2976 2356 S 1.3 0.3 0:00.04 sshd

    15354 shairpo+ 20 0 131816 8952 7216 S 1.0 0.9 103:32.46 shairport+

    7 root 20 0 0 0 0 R 0.7 0.0 38:13.79 rcu_sched

    1312 root 19 -1 32176 4456 3264 S 0.7 0.5 27:20.60 systemd-j+

    2165 root 20 0 7752 1496 1300 S 0.7 0.2 108:12.83 system-in+

    25160 root 20 0 69696 32004 9132 S 0.7 3.4 146:41.33 nas-media+

    1 root 20 0 34548 6760 4464 S 0.3 0.7 44:34.46 systemd

    755 root 20 0 0 0 0 D 0.3 0.0 48:09.61 log_udisk+

    打开系统探针，看到系统日志上有很多不正常的记录

    [1180120.162911]IPVS: Creating netns size=920 id=5463

    [1180123.451849]IPVS: Creating netns size=920 id=5464

    [1180127.182695]IPVS: Creating netns size=920 id=5465

    [1180130.808287]IPVS: Creating netns size=920 id=5466

    [1180134.146460]IPVS: Creating netns size=920 id=5467

    [1180137.713379]IPVS: Creating netns size=920 id=5468

    [1180141.002576]IPVS: Creating netns size=920 id=5469

    [1180144.368947]IPVS: Creating netns size=920 id=5470

    [1180147.633079]IPVS: Creating netns size=920 id=5471

    [1180151.285139]IPVS: Creating netns size=920 id=5472

    [1180154.844667]IPVS: Creating netns size=920 id=5473

    [1180158.135347]IPVS: Creating netns size=920 id=5474

    [1180161.627679]IPVS: Creating netns size=920 id=5475

    [1180165.211552]IPVS: Creating netns size=920 id=5476

    [1180169.018088]IPVS: Creating netns size=920 id=5477

    [1180172.606314]IPVS: Creating netns size=920 id=5478

    [1180176.055916]IPVS: Creating netns size=920 id=5479

    [1180179.397844]IPVS: Creating netns size=920 id=5480

    [1180182.464897]IPVS: Creating netns size=920 id=5481

    [1180186.267898]IPVS: Creating netns size=920 id=5482

    [1180189.626823]IPVS: Creating netns size=920 id=5483

    [1180193.413778]IPVS: Creating netns size=920 id=5484

    [1180196.405582]IPVS: Creating netns size=920 id=5485

    [1180199.807499]IPVS: Creating netns size=920 id=5486

    [1180203.634362]IPVS: Creating netns size=920 id=5487

    [1180207.007687]IPVS: Creating netns size=920 id=5488

    [1180211.132149]IPVS: Creating netns size=920 id=5489

    [1180214.899165]IPVS: Creating netns size=920 id=5490

    [1180217.753984]IPVS: Creating netns size=920 id=5491

    [1180221.368701]IPVS: Creating netns size=920 id=5492

    [1180224.523024]IPVS: Creating netns size=920 id=5493

    [1180228.101610]IPVS: Creating netns size=920 id=5494

    [1180230.906521]IPVS: Creating netns size=920 id=5495

    [1180234.969385]IPVS: Creating netns size=920 id=5496

    [1180238.570366]IPVS: Creating netns size=920 id=5497

    [1180241.402126]IPVS: Creating netns size=920 id=5498

    [1180245.329313]IPVS: Creating netns size=920 id=5499

    [1180248.790780]IPVS: Creating netns size=920 id=5500

    [1180252.648571]IPVS: Creating netns size=920 id=5501

    [1180256.045716]IPVS: Creating netns size=920 id=5502

    [1180258.998569]IPVS: Creating netns size=920 id=5503

    [1180262.239930]IPVS: Creating netns size=920 id=5504

    [1180265.031397]IPVS: Creating netns size=920 id=5505

    [1180268.754977]IPVS: Creating netns size=920 id=5506

    [1180271.687252]IPVS: Creating netns size=920 id=5507

    [1180274.729095]IPVS: Creating netns size=920 id=5508

    [1180277.517690]IPVS: Creating netns size=920 id=5509

    [1180281.043712]IPVS: Creating netns size=920 id=5510

    [1180284.447050]IPVS: Creating netns size=920 id=5511

    [1180287.909744]IPVS: Creating netns size=920 id=5512

    [1180291.165667]IPVS: Creating netns size=920 id=5513

    [1180295.274329]IPVS: Creating netns size=920 id=5514

    [1180298.595368]IPVS: Creating netns size=920 id=5515

    [1180301.015300]IPVS: Creating netns size=920 id=5516

    [1180304.690559]IPVS: Creating netns size=920 id=5517

    [1180307.613428]IPVS: Creating netns size=920 id=5518

    [1180310.931165]IPVS: Creating netns size=920 id=5519

    [1180313.298922]IPVS: Creating netns size=920 id=5520

    [1180316.752911]IPVS: Creating netns size=920 id=5521

    [1180319.628780]IPVS: Creating netns size=920 id=5522

    [1180322.956541]IPVS: Creating netns size=920 id=5523

    [1180325.981695]IPVS: Creating netns size=920 id=5524

    [1180329.421598]IPVS: Creating netns size=920 id=5525

    [1180332.114483]IPVS: Creating netns size=920 id=5526

    [1180335.167955]IPVS: Creating netns size=920 id=5527

    [1180338.677824]IPVS: Creating netns size=920 id=5528

    [1180342.230067]IPVS: Creating netns size=920 id=5529

    [1180345.323062]IPVS: Creating netns size=920 id=5530

    [1180348.878572]IPVS: Creating netns size=920 id=5531

    [1180351.828499]IPVS: Creating netns size=920 id=5532

    [1180355.163639]IPVS: Creating netns size=920 id=5533

    [1180358.062944]IPVS: Creating netns size=920 id=5534

    [1180362.044182]IPVS: Creating netns size=920 id=5535

    [1180365.232462]IPVS: Creating netns size=920 id=5536

    [1180368.200240]IPVS: Creating netns size=920 id=5537

    [1180371.573120]IPVS: Creating netns size=920 id=5538

    [1180374.348001]IPVS: Creating netns size=920 id=5539

    [1180377.529937]IPVS: Creating netns size=920 id=5540

    [1180380.429480]IPVS: Creating netns size=920 id=5541

    [1180383.742872]IPVS: Creating netns size=920 id=5542

    [1180386.512668]IPVS: Creating netns size=920 id=5543

    [1180389.688615]IPVS: Creating netns size=920 id=5544

    [1180392.579104]IPVS: Creating netns size=920 id=5545

    [1180396.220324]IPVS: Creating netns size=920 id=5546

    [1180399.454701]IPVS: Creating netns size=920 id=5547

    [1180403.038173]IPVS: Creating netns size=920 id=5548

    [1180405.710104]IPVS: Creating netns size=920 id=5549

    [1180406.950202]IPVS: Creating netns size=920 id=5550

    [1180409.140689]IPVS: Creating netns size=920 id=5551

    [1180412.097843]IPVS: Creating netns size=920 id=5552

    [1180415.502802]IPVS: Creating netns size=920 id=5553

    [1180418.962893]IPVS: Creating netns size=920 id=5554

    [1180422.862554]IPVS: Creating netns size=920 id=5555

    [1180426.285455]IPVS: Creating netns size=920 id=5556

    [1180429.579635]IPVS: Creating netns size=920 id=5557

    [1180433.297123]IPVS: Creating netns size=920 id=5558

    [1180436.217166]IPVS: Creating netns size=920 id=5559

    [1180439.929405]IPVS: Creating netns size=920 id=5560

    [1180443.332007]IPVS: Creating netns size=920 id=5561

    [1180446.288869]IPVS: Creating netns size=920 id=5562

    意识到系统正在遭受猛烈攻击，平均每3-4秒创建一个新的网络命名空间，

    这是典型的分布式暴力破解攻击特征，攻击者在：

    1、不断更换IP地址（通过创建新的netns）

    2、尝试不同的用户名/密码组合

    3、试图绕过防火墙限制

    通过查询发现大量国外ip在连接ssh的22端口。

    root@hi3798mv100:~# sudo netstat -tnpa | grep ':22 ’

    tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2303/sshd: /usr/sbi

    tcp 0 0 192.168.1.3:22 110.173.190.221:59836 ESTABLISHED 3218/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:56364 ESTABLISHED 3196/sshd: [accepte

    tcp 0 0 192.168.1.3:22 192.168.1.7:51611 ESTABLISHED 2736/sshd: root@not

    tcp 0 0 192.168.1.3:22 45.142.193.164:44980 ESTABLISHED 3122/sshd: root [pr

    tcp 0 64 192.168.1.3:22 192.168.1.7:51667 ESTABLISHED 2798/sshd: root@pts

    tcp 0 52 192.168.1.3:22 110.173.190.221:59860 ESTABLISHED 3230/sshd: [accepte

    tcp 0 0 192.168.1.3:22 45.142.193.164:47932 ESTABLISHED 3221/sshd: [accepte

    tcp 0 0 192.168.1.3:22 110.173.190.221:59804 ESTABLISHED 3204/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:53384 ESTABLISHED 3086/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:36538 ESTABLISHED 3147/sshd: [accepte

    tcp6 0 0 :::22 :::* LISTEN 2303/sshd: /usr/sbi

    root@hi3798mv100:~# sudo netstat -tnpa | grep ESTABLISHED

    tcp 0 0 192.168.1.3:111 81.19.216.107:53167 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:50396 ESTABLISHED 21421/smbd

    tcp 0 0 192.168.1.3:111 89.37.172.142:50188 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.109.8:58278 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33614 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:33624 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:445 192.168.1.7:50583 ESTABLISHED 28032/smbd

    tcp 0 0 192.168.1.3:111 45.33.12.214:36206 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.12.122:40418 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.245:43617 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:64003 ESTABLISHED 31504/smbd

    tcp 0 0 192.168.1.3:33628 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:33620 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 42 192.168.1.3:7681 192.168.1.7:56331 ESTABLISHED 2283/ttyd

    tcp 0 0 192.168.1.3:445 192.168.1.7:50133 ESTABLISHED 10718/smbd

    tcp 0 0 192.168.1.3:111 72.14.178.148:40245 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:49622 ESTABLISHED 6642/smbd

    tcp 0 0 192.168.1.3:111 45.33.109.8:58273 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.230:58021 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33636 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 69.5.169.15:36252 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.209:46225 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.12.214:36211 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:42972 223.193.44.135:443 ESTABLISHED 29783/rclone

    tcp 0 0 192.168.1.3:445 192.168.1.7:49159 ESTABLISHED 22072/smbd

    tcp 0 0 192.168.1.3:80 192.168.1.7:61434 ESTABLISHED 8371/nginx: worker

    tcp 0 0 192.168.1.3:445 192.168.1.7:53777 ESTABLISHED 3850/smbd

    tcp 0 0 192.168.1.3:111 45.33.14.5:49279 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33618 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 69.5.169.188:54459 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:56666 123.139.248.9:16877 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 45.33.14.5:49280 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.109.8:58274 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:50136 ESTABLISHED 11718/smbd

    tcp 0 0 192.168.1.3:33634 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 193.32.209.254:64482 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:51537 ESTABLISHED 2697/smbd

    tcp 0 0 192.168.1.3:33630 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:445 192.168.1.7:50219 ESTABLISHED 16881/smbd

    tcp 0 0 192.168.1.3:111 194.50.235.139:21784 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:49788 ESTABLISHED 26797/smbd

    tcp 0 0 192.168.1.3:445 192.168.1.7:49394 ESTABLISHED 26830/smbd

    tcp6 0 0 2408:8220:6a33^-^58795 2408:8220:9e12:d2:51414 ESTABLISHED 5873/transmission-d

    tcp6 0 0 2408:8220:6a33^-^35714 2606:4700:3030::681:443 ESTABLISHED 5873/transmission-d

    tcp6 0 0 2408:8220:6a33^-^54110 2606:4700:3032::ac4:443 ESTABLISHED 5873/transmission-d

    但好在没有发现ssh除了本地ip外成功登录的记录，说明密码没有被破解。

    发现有10几个外国ip在进行RPCbind 扫描，端口111

    应对策略如下：

    1、关闭RPCbind 和111端口

    sudo systemctl stop rpcbind

    sudo systemctl disable rpcbind

    sudo iptables -A INPUT -p tcp --dport 111 -j DROP

    sudo iptables -A INPUT -p udp --dport 111 -j DROP

    2、更改ssh端口22为其他不常用的

    3、改个更强的root密码，全数字不放心啊

    改完重启，又关注了半个小时，发现还是有零星的攻击记录，但明显少了很多。

    [1187590.747109]IPVS: Creating netns size=920 id=5565

    [1187602.390013]IPVS: Creating netns size=920 id=5566

    [1188213.017468]IPVS: Creating netns size=920 id=5567

    [1188221.757152]IPVS: Creating netns size=920 id=5568

    [1188232.298696]IPVS: Creating netns size=920 id=5569

    [1188281.303100]IPVS: Creating netns size=920 id=5570

    [1188302.976535]IPVS: Creating netns size=920 id=5571

    [1188329.791320]IPVS: Creating netns size=920 id=5572

    [1188350.719354]IPVS: Creating netns size=920 id=5573

    [1188583.287798]IPVS: Creating netns size=920 id=5574

    [1188591.928067]IPVS: Creating netns size=920 id=5575

    [1188628.705282]IPVS: Creating netns size=920 id=5576

    [1188734.496476]IPVS: Creating netns size=920 id=5577

    [1190634.355193]IPVS: Creating netns size=920 id=5578

    又通过/etc/hosts.deny封禁了几个ip，至此到现在已经过去几个小时了，再也没有出现新的攻击记录。

    这是我第一次被暴力破解，之前一直觉得一个小盒子，不会有人无聊到攻击，

    现在发现还是大意了，这可能跟我有公网ip有关，如果没有公网ip会安全很多。

    另外sshd的默认配置/etc/ssh/sshd_config 很弱，

    安全功能几乎都没有配置，建议每个人都配置一下，

    惊心动魄的一下午，给新手做个参考，

    高手也多给点指点，我也是没有经验，瞎摸索的，

    有经验的大佬多指点指点安全方面的建议，让我们共同维护好这个小盒子。后发现cpu的占用不太正常，平常一般在5%以内，现在在15%左右。

    打开终端，在top里看到多个sshd进程的cpu占用较高，

    top - 09:20:35 up 13 days, 16:33, 1 user, load average: 7.27, 6.84, 6.70

    Tasks: 211 total, 2 running, 209 sleeping, 0 stopped, 0 zombie

    %Cpu(s): 9.2 us, 5.2 sy, 0.0 ni, 85.6 id, 0.0 wa, 0.0 hi, 0.1 si, 0.0 st

    MiB Mem : 928.1 total, 138.2 free, 410.8 used, 379.1 buff/cache

    MiB Swap: 0.0 total, 0.0 free, 0.0 used. 467.6 avail Mem

    PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

    32181 root 20 0 11324 5456 4604 S 7.9 0.6 0:00.24 sshd

    32171 root 20 0 11324 5456 4604 S 5.0 0.6 0:00.22 sshd

    5873 debian-+ 20 0 219708 145096 8748 S 3.6 15.3 579:08.41 transmiss+

    32266 root 20 0 9220 4684 4092 S 1.7 0.5 0:00.05 sshd

    2136 message+ 20 0 6640 3652 2608 S 1.3 0.4 78:02.23 dbus-daem+

    25187 www-data 20 0 203428 17612 13708 S 1.3 1.9 0:01.63 php-fpm7.4

    32147 root 20 0 9860 2420 2076 R 1.3 0.3 0:00.15 top

    32160 sshd 20 0 9220 2956 2336 S 1.3 0.3 0:00.04 sshd

    32173 sshd 20 0 9220 2968 2352 S 1.3 0.3 0:00.04 sshd

    32182 sshd 20 0 9220 2976 2356 S 1.3 0.3 0:00.04 sshd

    15354 shairpo+ 20 0 131816 8952 7216 S 1.0 0.9 103:32.46 shairport+

    7 root 20 0 0 0 0 R 0.7 0.0 38:13.79 rcu_sched

    1312 root 19 -1 32176 4456 3264 S 0.7 0.5 27:20.60 systemd-j+

    2165 root 20 0 7752 1496 1300 S 0.7 0.2 108:12.83 system-in+

    25160 root 20 0 69696 32004 9132 S 0.7 3.4 146:41.33 nas-media+

    1 root 20 0 34548 6760 4464 S 0.3 0.7 44:34.46 systemd

    755 root 20 0 0 0 0 D 0.3 0.0 48:09.61 log_udisk+

    打开系统探针，看到系统日志上有很多不正常的记录

    [1180120.162911]IPVS: Creating netns size=920 id=5463

    [1180123.451849]IPVS: Creating netns size=920 id=5464

    [1180127.182695]IPVS: Creating netns size=920 id=5465

    [1180130.808287]IPVS: Creating netns size=920 id=5466

    [1180134.146460]IPVS: Creating netns size=920 id=5467

    [1180137.713379]IPVS: Creating netns size=920 id=5468

    [1180141.002576]IPVS: Creating netns size=920 id=5469

    [1180144.368947]IPVS: Creating netns size=920 id=5470

    [1180147.633079]IPVS: Creating netns size=920 id=5471

    [1180151.285139]IPVS: Creating netns size=920 id=5472

    [1180154.844667]IPVS: Creating netns size=920 id=5473

    [1180158.135347]IPVS: Creating netns size=920 id=5474

    [1180161.627679]IPVS: Creating netns size=920 id=5475

    [1180165.211552]IPVS: Creating netns size=920 id=5476

    [1180169.018088]IPVS: Creating netns size=920 id=5477

    [1180172.606314]IPVS: Creating netns size=920 id=5478

    [1180176.055916]IPVS: Creating netns size=920 id=5479

    [1180179.397844]IPVS: Creating netns size=920 id=5480

    [1180182.464897]IPVS: Creating netns size=920 id=5481

    [1180186.267898]IPVS: Creating netns size=920 id=5482

    [1180189.626823]IPVS: Creating netns size=920 id=5483

    [1180193.413778]IPVS: Creating netns size=920 id=5484

    [1180196.405582]IPVS: Creating netns size=920 id=5485

    [1180199.807499]IPVS: Creating netns size=920 id=5486

    [1180203.634362]IPVS: Creating netns size=920 id=5487

    [1180207.007687]IPVS: Creating netns size=920 id=5488

    [1180211.132149]IPVS: Creating netns size=920 id=5489

    [1180214.899165]IPVS: Creating netns size=920 id=5490

    [1180217.753984]IPVS: Creating netns size=920 id=5491

    [1180221.368701]IPVS: Creating netns size=920 id=5492

    [1180224.523024]IPVS: Creating netns size=920 id=5493

    [1180228.101610]IPVS: Creating netns size=920 id=5494

    [1180230.906521]IPVS: Creating netns size=920 id=5495

    [1180234.969385]IPVS: Creating netns size=920 id=5496

    [1180238.570366]IPVS: Creating netns size=920 id=5497

    [1180241.402126]IPVS: Creating netns size=920 id=5498

    [1180245.329313]IPVS: Creating netns size=920 id=5499

    [1180248.790780]IPVS: Creating netns size=920 id=5500

    [1180252.648571]IPVS: Creating netns size=920 id=5501

    [1180256.045716]IPVS: Creating netns size=920 id=5502

    [1180258.998569]IPVS: Creating netns size=920 id=5503

    [1180262.239930]IPVS: Creating netns size=920 id=5504

    [1180265.031397]IPVS: Creating netns size=920 id=5505

    [1180268.754977]IPVS: Creating netns size=920 id=5506

    [1180271.687252]IPVS: Creating netns size=920 id=5507

    [1180274.729095]IPVS: Creating netns size=920 id=5508

    [1180277.517690]IPVS: Creating netns size=920 id=5509

    [1180281.043712]IPVS: Creating netns size=920 id=5510

    [1180284.447050]IPVS: Creating netns size=920 id=5511

    [1180287.909744]IPVS: Creating netns size=920 id=5512

    [1180291.165667]IPVS: Creating netns size=920 id=5513

    [1180295.274329]IPVS: Creating netns size=920 id=5514

    [1180298.595368]IPVS: Creating netns size=920 id=5515

    [1180301.015300]IPVS: Creating netns size=920 id=5516

    [1180304.690559]IPVS: Creating netns size=920 id=5517

    [1180307.613428]IPVS: Creating netns size=920 id=5518

    [1180310.931165]IPVS: Creating netns size=920 id=5519

    [1180313.298922]IPVS: Creating netns size=920 id=5520

    [1180316.752911]IPVS: Creating netns size=920 id=5521

    [1180319.628780]IPVS: Creating netns size=920 id=5522

    [1180322.956541]IPVS: Creating netns size=920 id=5523

    [1180325.981695]IPVS: Creating netns size=920 id=5524

    [1180329.421598]IPVS: Creating netns size=920 id=5525

    [1180332.114483]IPVS: Creating netns size=920 id=5526

    [1180335.167955]IPVS: Creating netns size=920 id=5527

    [1180338.677824]IPVS: Creating netns size=920 id=5528

    [1180342.230067]IPVS: Creating netns size=920 id=5529

    [1180345.323062]IPVS: Creating netns size=920 id=5530

    [1180348.878572]IPVS: Creating netns size=920 id=5531

    [1180351.828499]IPVS: Creating netns size=920 id=5532

    [1180355.163639]IPVS: Creating netns size=920 id=5533

    [1180358.062944]IPVS: Creating netns size=920 id=5534

    [1180362.044182]IPVS: Creating netns size=920 id=5535

    [1180365.232462]IPVS: Creating netns size=920 id=5536

    [1180368.200240]IPVS: Creating netns size=920 id=5537

    [1180371.573120]IPVS: Creating netns size=920 id=5538

    [1180374.348001]IPVS: Creating netns size=920 id=5539

    [1180377.529937]IPVS: Creating netns size=920 id=5540

    [1180380.429480]IPVS: Creating netns size=920 id=5541

    [1180383.742872]IPVS: Creating netns size=920 id=5542

    [1180386.512668]IPVS: Creating netns size=920 id=5543

    [1180389.688615]IPVS: Creating netns size=920 id=5544

    [1180392.579104]IPVS: Creating netns size=920 id=5545

    [1180396.220324]IPVS: Creating netns size=920 id=5546

    [1180399.454701]IPVS: Creating netns size=920 id=5547

    [1180403.038173]IPVS: Creating netns size=920 id=5548

    [1180405.710104]IPVS: Creating netns size=920 id=5549

    [1180406.950202]IPVS: Creating netns size=920 id=5550

    [1180409.140689]IPVS: Creating netns size=920 id=5551

    [1180412.097843]IPVS: Creating netns size=920 id=5552

    [1180415.502802]IPVS: Creating netns size=920 id=5553

    [1180418.962893]IPVS: Creating netns size=920 id=5554

    [1180422.862554]IPVS: Creating netns size=920 id=5555

    [1180426.285455]IPVS: Creating netns size=920 id=5556

    [1180429.579635]IPVS: Creating netns size=920 id=5557

    [1180433.297123]IPVS: Creating netns size=920 id=5558

    [1180436.217166]IPVS: Creating netns size=920 id=5559

    [1180439.929405]IPVS: Creating netns size=920 id=5560

    [1180443.332007]IPVS: Creating netns size=920 id=5561

    [1180446.288869]IPVS: Creating netns size=920 id=5562

    意识到系统正在遭受猛烈攻击，平均每3-4秒创建一个新的网络命名空间，

    这是典型的分布式暴力破解攻击特征，攻击者在：

    1、不断更换IP地址（通过创建新的netns）

    2、尝试不同的用户名/密码组合

    3、试图绕过防火墙限制

    通过查询发现大量国外ip在连接ssh的22端口。

    root@hi3798mv100:~# sudo netstat -tnpa | grep ':22 ’

    tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2303/sshd: /usr/sbi

    tcp 0 0 192.168.1.3:22 110.173.190.221:59836 ESTABLISHED 3218/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:56364 ESTABLISHED 3196/sshd: [accepte

    tcp 0 0 192.168.1.3:22 192.168.1.7:51611 ESTABLISHED 2736/sshd: root@not

    tcp 0 0 192.168.1.3:22 45.142.193.164:44980 ESTABLISHED 3122/sshd: root [pr

    tcp 0 64 192.168.1.3:22 192.168.1.7:51667 ESTABLISHED 2798/sshd: root@pts

    tcp 0 52 192.168.1.3:22 110.173.190.221:59860 ESTABLISHED 3230/sshd: [accepte

    tcp 0 0 192.168.1.3:22 45.142.193.164:47932 ESTABLISHED 3221/sshd: [accepte

    tcp 0 0 192.168.1.3:22 110.173.190.221:59804 ESTABLISHED 3204/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:53384 ESTABLISHED 3086/sshd: root [pr

    tcp 0 0 192.168.1.3:22 45.142.193.164:36538 ESTABLISHED 3147/sshd: [accepte

    tcp6 0 0 :::22 :::* LISTEN 2303/sshd: /usr/sbi

    root@hi3798mv100:~# sudo netstat -tnpa | grep ESTABLISHED

    tcp 0 0 192.168.1.3:111 81.19.216.107:53167 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:50396 ESTABLISHED 21421/smbd

    tcp 0 0 192.168.1.3:111 89.37.172.142:50188 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.109.8:58278 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33614 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:33624 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:445 192.168.1.7:50583 ESTABLISHED 28032/smbd

    tcp 0 0 192.168.1.3:111 45.33.12.214:36206 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.12.122:40418 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.245:43617 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:64003 ESTABLISHED 31504/smbd

    tcp 0 0 192.168.1.3:33628 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:33620 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 42 192.168.1.3:7681 192.168.1.7:56331 ESTABLISHED 2283/ttyd

    tcp 0 0 192.168.1.3:445 192.168.1.7:50133 ESTABLISHED 10718/smbd

    tcp 0 0 192.168.1.3:111 72.14.178.148:40245 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:49622 ESTABLISHED 6642/smbd

    tcp 0 0 192.168.1.3:111 45.33.109.8:58273 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.230:58021 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33636 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 69.5.169.15:36252 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 69.5.169.209:46225 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.12.214:36211 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:42972 223.193.44.135:443 ESTABLISHED 29783/rclone

    tcp 0 0 192.168.1.3:445 192.168.1.7:49159 ESTABLISHED 22072/smbd

    tcp 0 0 192.168.1.3:80 192.168.1.7:61434 ESTABLISHED 8371/nginx: worker

    tcp 0 0 192.168.1.3:445 192.168.1.7:53777 ESTABLISHED 3850/smbd

    tcp 0 0 192.168.1.3:111 45.33.14.5:49279 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:33618 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 69.5.169.188:54459 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:56666 123.139.248.9:16877 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 45.33.14.5:49280 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:111 45.33.109.8:58274 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:50136 ESTABLISHED 11718/smbd

    tcp 0 0 192.168.1.3:33634 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:111 193.32.209.254:64482 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:51537 ESTABLISHED 2697/smbd

    tcp 0 0 192.168.1.3:33630 104.17.153.215:443 ESTABLISHED 5873/transmission-d

    tcp 0 0 192.168.1.3:445 192.168.1.7:50219 ESTABLISHED 16881/smbd

    tcp 0 0 192.168.1.3:111 194.50.235.139:21784 ESTABLISHED 2060/rpcbind

    tcp 0 0 192.168.1.3:445 192.168.1.7:49788 ESTABLISHED 26797/smbd

    tcp 0 0 192.168.1.3:445 192.168.1.7:49394 ESTABLISHED 26830/smbd

    tcp6 0 0 2408:8220:6a33^-^58795 2408:8220:9e12:d2:51414 ESTABLISHED 5873/transmission-d

    tcp6 0 0 2408:8220:6a33^-^35714 2606:4700:3030::681:443 ESTABLISHED 5873/transmission-d

    tcp6 0 0 2408:8220:6a33^-^54110 2606:4700:3032::ac4:443 ESTABLISHED 5873/transmission-d

    但好在没有发现ssh除了本地ip外成功登录的记录，说明密码没有被破解。

    发现有10几个外国ip在进行RPCbind 扫描，端口111

    应对策略如下：

    1、关闭RPCbind 和111端口

    sudo systemctl stop rpcbind

    sudo systemctl disable rpcbind

    sudo iptables -A INPUT -p tcp --dport 111 -j DROP

    sudo iptables -A INPUT -p udp --dport 111 -j DROP

    2、更改ssh端口22为其他不常用的

    3、改个更强的root密码，全数字不放心啊

    改完重启，又关注了半个小时，发现还是有零星的攻击记录，但明显少了很多。

    [1187590.747109]IPVS: Creating netns size=920 id=5565

    [1187602.390013]IPVS: Creating netns size=920 id=5566

    [1188213.017468]IPVS: Creating netns size=920 id=5567

    [1188221.757152]IPVS: Creating netns size=920 id=5568

    [1188232.298696]IPVS: Creating netns size=920 id=5569

    [1188281.303100]IPVS: Creating netns size=920 id=5570

    [1188302.976535]IPVS: Creating netns size=920 id=5571

    [1188329.791320]IPVS: Creating netns size=920 id=5572

    [1188350.719354]IPVS: Creating netns size=920 id=5573

    [1188583.287798]IPVS: Creating netns size=920 id=5574

    [1188591.928067]IPVS: Creating netns size=920 id=5575

    [1188628.705282]IPVS: Creating netns size=920 id=5576

    [1188734.496476]IPVS: Creating netns size=920 id=5577

    [1190634.355193]IPVS: Creating netns size=920 id=5578

    又通过/etc/hosts.deny封禁了几个ip，至此到现在已经过去几个小时了，再也没有出现新的攻击记录。

    这是我第一次被暴力破解，之前一直觉得一个小盒子，不会有人无聊到攻击，

    现在发现还是大意了，这可能跟我有公网ip有关，如果没有公网ip会安全很多。

    另外sshd的默认配置/etc/ssh/sshd_config 很弱，

    安全功能几乎都没有配置，建议每个人都配置一下，

    惊心动魄的一下午，给新手做个参考，

    高手也多给点指点，我也是没有经验，瞎摸索的，

    有经验的大佬多指点指点安全方面的建议。

    主楼
  • 慕容泠鸢
    慕容泠鸢2026-08-14
    40442

    绝大多数情况一个强密码可以解决爆破,实在不行上秘钥对

    #1
  • lovesusu
    lovesusu2026-08-14
    6034

    一般都是自动化的攻击，扫到了服务就自动跑字典，最常规的就是改掉常用端口，不需要的服务不监听到0.0.0.0上

    #2
  • 上界司命
    上界司命2026-08-14
    9026

    家里的路由器不能过滤IP么？ 路由器设置不了的话也可以套层waf，我用的主路由是ikuai 端口映射的时候我把非本省IP全ban了。有些比较广的服务端口也ban外国ip

    #3
  • Atoz_03
    Atoz_032026-08-14
    20635

    可以放<div data-theme-scrollable="true"> </div> 里面，观感有点差

    #4
  • Taru
    Taru2026-08-14
    33219

    我所有机器ssh全部禁密码登录，只用密钥，这要能被爆破那该睡不着的就不是我了

    #5
  • AAEE86
    AAEE862026-08-14
    6313

    家里nas外网访问还是设置下ip白名单吧，嫌麻烦可以设置成你所在城市的IP段

    #6
  • adtest
    adtest2026-08-14
    62245

    所有常见的端口不要使用默认端口，而且你那个22如果需要使用就随机一个端口就行比如2w以上的端口，如果不需要使用直接就关了

    #7
  • 风过留香
    风过留香2026-08-14
    9089

    还不敢在路由器上直接这么操作，用的有pt啊

    #8
  • 风过留香
    风过留香2026-08-14
    9089

    是啊，已经改了12位强密码，应该可以的

    #9
  • 风过留香
    风过留香2026-08-14
    9089

    嗯嗯，我打算再做一个html，放在web，写上是个小盒子，高手求放过

    #10

发表回复

登录后回复