河蟹社会

Feb 22 04:36:25 gw sshd[4528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.23.*.* user=root
Feb 22 04:36:27 gw sshd[4528]: Failed password for root from 50.23.*.* port 45718 ssh2
Feb 22 04:36:29 gw sshd[4530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.23.*.* user=root
Feb 22 04:36:32 gw sshd[4530]: Failed password for root from 50.23.*.* port 46262 ssh2
Feb 22 04:36:34 gw sshd[4532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.23.*.* user=root

主机商发来类似这样的log信息，rhost后面是我的IP，是我的VPS被黑后在破解别人的密码？

糕手

杯具……

yc260982

悲剧了你！

woaijay987

应该是在扫描

wdlth

我的VPS很干净，买的时间很短，上面还没有做站，密码绝对复杂，不会被轻易破解。

唯一的疑问是安装了国人的某个一键包，等看看情况吧

河蟹社会

原帖由 河蟹社会 于 2011-2-22 22:30 发表


Feb 22 04:36:25 gw sshd[4528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.23.*.* user=root
Feb 22 04:36:27 gw sshd[4528]: Failed password for root from  ...
这明明是你在被扫描，主机商怎么能用这个为理由suspend你？

windywinter

会不会是网内另一台VPS的log？

我是人

这个要和客服理论一下的

挨个搞

*****************************************************************************************
* THIS IS AN URGENT ABUSE MATTER - IMMEDIATE ACTION REQUIRED - IMPORTANT DETAILS FOLLOW *
*****************************************************************************************

YOU MUST RESPOND TO THIS NOTICE - Even if the offending account has already been suspended or terminated! If we do not hear back from you within 48 hours to confirm receipt of this message and your actions taken to prevent further abuse from occurring on your account, your ENTIRE ACCOUNT will be subject to suspension or termination at our discretion.

This is an abuse matter that is handled ONLY by our Abuse Department and requires your immediate attention and cooperation. Our Abuse Department is available only via email and our ticket system. This is not a support matter, and therefore our support agents CANNOT ASSIST YOU. We cannot provide any information or assistance via our phone system or live chat service. If you attempt to call or chat regarding an abuse issue you will be instructed to send an email. Repeated attempts to call or chat regarding abuse issues will result in your access to these systems being revoked.

If you are a reseller or dedicated server customer, it is your responsibility to reasonably monitor your clients' activities and to respond to our notices in a timely fashion. If you fail to properly act or respond to our notice, or we receive repeated and continuous complaints regarding your accounts, we reserve the right to suspend or terminate your entire reseller and/or dedicated server without further warning.

********************************************************************************************************Pending your REQUIRED REPLY with comments, questions, or actions being taken to resolve this issue, we:

[] Will MONITOR This Account for Additional Violations
[] Will SUSPEND this account in: [] 48-Hours [] 24-Hours [] 12-Hours [] 8-Hours [] 4-Hours
[XXX] Have TEMPORARILY SUSPENDED this account pending your action to resolve this matter
[] Have PERMANENTLY SUSPENDED and will TERMINATE this account with: [] No Backups Provided [] Backups Available Upon Request
* Please note that any permanently suspended account will be terminated after 48 hours. You must contact us for backups (if allowed) before this time.
[] Have Placed This Account On 30 DAY PROBATION subject to TERMINATION for any further violations
[] Will REVIEW this account for POSSIBLE IMMEDIATE TERMINATION
[] Have PERMANENTLY TERMINATED this account without possibility of data recovery

For the following reason(s) (only the marked reason(s) apply):

[] Child **ography - Hosting, Distributing, or Linking to **ography Involving a Person Under Legal Age
[] Copyright Infringement - Hosting, Distributing, or Linking to Copyright Infringed Materials
[] CPU/Memory/Resource Abuse - Consuming Excessive Amount of Server Resources Causing Server Performance Issues
[XXX] DoS Source - Source of Denial of Service Attack
[] DoS Target - Target of Denial of Service Attack
[] Forgery - Faking an IP Address, Hostname, E-Mail Address, or Header
[] Fraud Site - Hosting or Linking to a Website Intended to Deceive the Public
[] HYIP - Hosting or Linking to a High Yield Investment Program Website
[] Identity Theft - Hosting, Distributing, or Linking to Stolen Account Identification Information
[XXX] Infection - Hosting, Distributing, or Linking to Exploits, Trojans, Viruses, or Worms
[] IRC - Hosting Internet Relay Chat Server not Authorized by ClubUptime
[] Mass Storage - Storing Mass Amounts of Backups, Archives, Videos, etc
[] Phishing - Identity Theft by Email Under False Pretense
[] Proxy Site - Hosting of an Anonymous Proxy Server
[] Spam Email - Unsolicited Commercial Email (UCE) or Unsolicited Bulk Email (UBE)
[] Spam List - Hosting, Distributing, or Linking to Email Address Lists for Spam
[] Spam Site - A Site Advertised by Spam Email or Spam Web
[] Spam Ware - Hosting, Distributing, or Linking to Software Designed for Spamming
[] Spam Web - Unsolicited, Bulk, or Forged Site Advertisement in Web Logs, Forums, or Guestbooks
[] Spamhaus - Spam Causing Blacklisting of an IP at www.spamhaus.org for Malicious Activity
[] Terrorist Site - Hosting or Linking to a Site Advocating Terrorism
[XXX] Toolz - Hosting, Distributing, or Linking to Tools or Instructional Material on Hacking/Cracking or Other Illegal Activity
[] Trademark - Hosting, Distributing, or Linking to Trade Mark Infringed Materials
[] Warez - Hosting, Distributing, or Linking to Crackz, Hackz, KeyGenz, Serialz, or Pirated Software

[] OTHER:

Your immediate cooperation is anticipated to avoid further action being taken.

***********************************************************
* LOGS OR EVIDENCE REGARDING THIS ISSUE ARE LOCATED BELOW *
***********************************************************

河蟹社会

[XXX] Infection - Hosting, Distributing, or Linking to Exploits, Trojans, Viruses, or Worms
[XXX] Toolz - Hosting, Distributing, or Linking to Tools or Instructional Material on Hacking/Cracking or Other Illegal Activity

才留意到这两条，说我的VPS DDOS别人了

客服有回复，看看能不被解除