sshd日志文件在哪里，如何解释日志信息？
sshd日志文件在哪里，如何解释日志信息？
提问于 2017-02-25 02:56:30
在登录我的vps后输入日志。
journalctl _COMM=sshd -f
Feb 16 06:34:40 localhost sshd[324]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 38876
Feb 16 06:34:40 localhost sshd[325]: Did not receive identification string from 23.252.100.22
Feb 16 07:34:40 localhost sshd[326]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 40602
Feb 16 07:34:40 localhost sshd[327]: Did not receive identification string from 23.252.100.22
Feb 16 08:34:40 localhost sshd[328]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 38298
Feb 16 08:34:40 localhost sshd[329]: Did not receive identification string from 23.252.100.22
Feb 16 09:34:41 localhost sshd[348]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 42132
Feb 16 09:34:41 localhost sshd[349]: Did not receive identification string from 23.252.100.22
Feb 16 10:34:39 localhost sshd[350]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 60988
Feb 16 10:34:39 localhost sshd[351]: Did not receive identification string from 23.252.100.22
Feb 16 11:34:40 localhost sshd[352]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 33850
Feb 16 11:34:40 localhost sshd[353]: Did not receive identification string from 23.252.100.22
Feb 16 12:34:39 localhost sshd[354]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 44998
Feb 16 12:34:39 localhost sshd[355]: Did not receive identification string from 23.252.100.22
Feb 16 13:34:38 localhost sshd[356]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 52632
Feb 16 13:34:38 localhost sshd[357]: Did not receive identification string from 23.252.100.22
Feb 16 14:34:41 localhost sshd[358]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 43864
Feb 16 14:34:41 localhost sshd[359]: Did not receive identification string from 23.252.100.22
Feb 16 15:34:40 localhost sshd[360]: Bad protocol version identification 'GET / HTTP/1.0' from 23.252.100.22 port 53402
Feb 16 15:34:40 localhost sshd[361]: Did not receive identification string from 23.252.100.22日志是否意味着23.252.100.22 (不是我的ip，也不是我的vps )试图破解我的vps密钥？
包含这样的日志信息的文件在哪里？
回答 1
Security用户
发布于 2017-02-25 03:09:01
23.252.100.22端口38876中的错误协议版本标识'GET / HTTP/1.0‘
听起来像是一个机器人在向sshd发送格式错误的信息。这不仅不是版本字符串，而且是http请求的一行--这在ssh上下文中没有任何意义。
它可能是试图触发一些我不知道的漏洞，但我认为它可能只是编程不当。
无论哪种方式，答案都是一样的:执行标准的sshd强化操作。禁用密码，禁用根登录，安装和配置fail2ban。
页面原文内容由Security提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://security.stackexchange.com/questions/152319
复制相关文章
相似问题
腾讯云开发者
