记一次sshd攻击

现象

常规远程主机登录，登录失败，显示，

No supported authentication methods available (server sent: publickey)

开始还以为是密码输入错误，多次尝试后，发觉没这么简单。
直接登录主机，查看/var/log/auth.log，出现很多类似的信息

sshd[2007038]:  Disconnected from invalid user admin 139.144.177.25 port 59738 [preauth]

判断是从此IP地址发起的sshd攻击。因为多次用admin登录，次数超限，账号锁定。

黑客会全网扫描端口，发现可以协议端口，就会尝试暴利登录。

结论1，不要用admin做用户名。

因为是搭环境测试，偷懒，所以用了默认的用户名。
同时log里还有，用root用户名尝试登录的，但root用户名是预置的最高权限用户。

结论2 ，不要开启用root远程登录。

因为是用deepin的pam，网上的各种方法都试验了一边，都没解决，比如

• tally
• tally2
• passwd
• faillog
• faillock
  -…

结论3，每个发行版的账户机制不一样，解决的方式也不同。

以deepin为例，

1. 账户登录失败次数和锁定时长的配置文件是/var/lib/deepin/authenticate/config.json，基本是如下结构，

{
        "Limits": [
                {
                        "Type": "fingerprint",
                        "UnlockSecs": -1,
                        "MaxTries": 3
                },
                {
                        "Type": "password",
                        "UnlockSecs": 180,    #锁定的时长，后面配置了动态时长，这个值就不起作用
                        "MaxTries": 5,   #每5次失败锁定
                        "DynamicLimit": true,
                        "DynamicLimitUnlockSecs":[180,300,900,1800,3600,86400] # 多次失败，越来越长的锁定时间
                }
        ]
}

2. 账户锁定的模块策略在/etc/pam.d目录中。
3. 此目录中sshd文件是配置sshd的账户策略的，文件内容类似，

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# SELinux needs to be the first session rule.  This ensures that any
# lingering context has been cleared.  Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close

# Set the loginuid process attribute.
session    required     pam_loginuid.so

# Create a new session keyring.
session    optional     pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional     pam_motd.so  motd=/run/motd.dynamic
session    optional     pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session    required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context.  Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open

# Standard Un*x password updating.
@include common-password

每行顺序执行，都通过了，才可以登录。具体解释，请搜索PAM的相关帖子。
5. sshd是否用pam的配置在/etc/ssh/sshd_config文件中，

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

把UsePAM yes，这行注释掉，就可以恢复admin账户的sshd登录。此时PAM对账户的锁定并没有取消。如果长期用，建议不要注释这行。

推断：deepin的PAM锁定的账户没法直接取消锁定，只能等待。

---

其它

1. 是否允许root通过sshd登录的配置在/etc/ssh/sshd_config文件中。如果取消注释，就允许root通过sshd登录了。不建议取消注释

#PermitRootLogin prohibit-password

2. 备用一个用户名和密码都超级难的账户。万一犯浑时候，可以登录，然后用sudo su 切换应急。
3. 用fail2ban可以锁定攻击的ip。在配置文件jail.local修改sshd配置为,

enabled = true
port    = ssh
filter = sshd
logpath = %(sshd_log)s
backend = %(sshd_backend)s

如果出现类似错误，

ERROR   Failed during configuration: Have not found any log file for apache-auth jail

可以把jail.local里的这行改成false

# true:  jail will be enabled and log files will get monitored for changes
# false: jail is not enabled
enabled = false