一台机器被远程之后在auth日志中记录端口号是随机的 ssh默认端口不是22么 哪位高人给说下
以下是被远程之后auth日志记录
2021-07-27T22:40:46.403948+08:00 localhost sshd[1417]: Accepted password for root from 127.0.0.1 port 56842 ssh2
2021-07-27T22:40:46.404631+08:00 localhost sshd[1417]: pam_unix_session(sshd:session): session opened for user root by (uid=58)
2021-07-27T22:40:48.823212+08:00 localhost sshd[1417]: Received disconnect from 127.0.0.1 port 56842:11: disconnected by user
2021-07-27T22:40:48.823224+08:00 localhost sshd[1417]: Disconnected from user root 127.0.0.1 port 56842
localhost sshd[1417]: 这里说 的是 linux 本地 localhost 进程sshd pid[1417]
127.0.0.1 port 56842 这说的是 谁链接了linux 的sshd , 127.0.0.1 为链接方远程地址 和 远程端口 56842
奇怪的是127这个ip地址 , 环境是虚拟机吗?
可以在linux终端 netstat -ano |grep 22
看下 链接的具体情况
例如我的是这样子
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 192.168.111.137:22 192.168.111.2:9529 ESTABLISHED keepalive (5973.64/0/0)
tcp 0 36 192.168.111.137:22 192.168.111.2:7585 ESTABLISHED on (0.21/0/0)
tcp 0 0 192.168.111.137:22 192.168.111.2:7584 ESTABLISHED keepalive (3392.54/0/0)
日志是这样
Jul 27 07:01:17 localhost sshd[76984]: Accepted password for root from 192.168.111.2 port 7584 ssh2
Jul 27 07:01:17 localhost sshd[76984]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jul 27 07:01:18 localhost sshd[77045]: Accepted password for root from 192.168.111.2 port 7585 ssh2
Jul 27 07:01:18 localhost sshd[77045]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jul 27 07:41:53 localhost sshd[78292]: Accepted password for root from 192.168.111.2 port 9529 ssh2
Jul 27 07:41:53 localhost sshd[78292]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jul 27 09:12:44 localhost sshd[73009]: pam_unix(sshd:session): session closed for user root
Jul 27 09:12:44 localhost sshd[73093]: pam_unix(sshd:session): session closed for user root
Jul 27 09:13:17 localhost sshd[73896]: pam_unix(sshd:session): session closed for user root
linux 网络配置是这样子
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:8c:fa:72 brd ff:ff:ff:ff:ff:ff
inet 192.168.111.137/24 brd 192.168.111.255 scope global ens33
valid_lft forever preferred_lft forever
inet 192.168.111.128/24 brd 192.168.111.255 scope global secondary ens33
valid_lft forever preferred_lft forever
inet 192.168.111.138/24 brd 192.168.111.255 scope global secondary ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe8c:fa72/64 scope link
valid_lft forever preferred_lft forever