Дятлы долбят ssh
Привет всем, у меня тут проблемма, какой-то дятел уже пятый час долбит ssh c нескольких ip-шников. Как мне от него избавится. Вот пример лога.
Jan 08 15:33:15 skyhost-vds-22235 sshd[12820]: Received disconnect from 103.105.130.136 port 47100:11: Bye Bye [preauth] Jan 08 15:33:15 skyhost-vds-22235 sshd[12820]: Disconnected from authenticating user root 103.105.130.136 port 47100 [preauth] Jan 08 15:33:20 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=33:33:00:00:00:01:fa:16:3e:06:88:6c:86:dd SRC=fe80:0000:0000:0000:> Jan 08 15:33:20 skyhost-vds-22235 sshd[12827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=21> Jan 08 15:33:21 skyhost-vds-22235 sshd[12825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=19> Jan 08 15:33:22 skyhost-vds-22235 sshd[12827]: Failed password for root from 217.29.126.136 port 37656 ssh2 Jan 08 15:33:23 skyhost-vds-22235 sshd[12825]: Failed password for root from 193.187.119.69 port 53402 ssh2 Jan 08 15:33:23 skyhost-vds-22235 sshd[12827]: Received disconnect from 217.29.126.136 port 37656:11: Bye Bye [preauth] Jan 08 15:33:23 skyhost-vds-22235 sshd[12827]: Disconnected from authenticating user root 217.29.126.136 port 37656 [preauth] Jan 08 15:33:24 skyhost-vds-22235 sshd[12825]: Received disconnect from 193.187.119.69 port 53402:11: Bye Bye [preauth] Jan 08 15:33:24 skyhost-vds-22235 sshd[12825]: Disconnected from authenticating user root 193.187.119.69 port 53402 [preauth] Jan 08 15:33:38 skyhost-vds-22235 sshd[12829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=12> Jan 08 15:33:40 skyhost-vds-22235 sshd[12829]: Failed password for root from 120.31.131.172 port 58772 ssh2 Jan 08 15:33:41 skyhost-vds-22235 sshd[12829]: Received disconnect from 120.31.131.172 port 58772:11: Bye Bye [preauth] Jan 08 15:33:41 skyhost-vds-22235 sshd[12829]: Disconnected from authenticating user root 120.31.131.172 port 58772 [preauth] Jan 08 15:33:48 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:7f:b9:98:00:07:7d:63:f9:bf:08:00 SRC=195.54.160.155 DST=1> Jan 08 15:33:54 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:7f:b9:98:00:07:7d:63:f9:bf:08:00 SRC=92.63.197.83 DST=193> Jan 08 15:34:08 skyhost-vds-22235 sshd[12833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13> Jan 08 15:34:09 skyhost-vds-22235 sshd[12833]: Failed password for root from 139.155.2.6 port 48872 ssh2 Jan 08 15:34:11 skyhost-vds-22235 sshd[12833]: Received disconnect from 139.155.2.6 port 48872:11: Bye Bye [preauth] Jan 08 15:34:11 skyhost-vds-22235 sshd[12833]: Disconnected from authenticating user root 139.155.2.6 port 48872 [preauth] Jan 08 15:34:15 skyhost-vds-22235 sshd[12835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22> Jan 08 15:34:15 skyhost-vds-22235 sshd[12837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=19> Jan 08 15:34:16 skyhost-vds-22235 sshd[12835]: Failed password for root from 222.239.124.19 port 42240 ssh2 Jan 08 15:34:16 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:7f:b9:98:00:07:7d:63:f9:bf:08:00 SRC=193.57.40.20 DST=193> Jan 08 15:34:17 skyhost-vds-22235 sshd[12837]: Failed password for root from 193.187.119.69 port 39978 ssh2 Jan 08 15:34:18 skyhost-vds-22235 sshd[12835]: Received disconnect from 222.239.124.19 port 42240:11: Bye Bye [preauth] Jan 08 15:34:18 skyhost-vds-22235 sshd[12835]: Disconnected from authenticating user root 222.239.124.19 port 42240 [preauth] Jan 08 15:34:18 skyhost-vds-22235 sshd[12837]: Received disconnect from 193.187.119.69 port 39978:11: Bye Bye [preauth] Jan 08 15:34:18 skyhost-vds-22235 sshd[12837]: Disconnected from authenticating user root 193.187.119.69 port 39978 [preauth] Jan 08 15:34:19 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=33:33:00:00:00:01:fa:16:3e:06:88:6c:86:dd SRC=fe80:0000:0000:0000:> Jan 08 15:34:34 skyhost-vds-22235 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:7f:b9:98:00:07:7d:63:f9:bf:08:00 SRC=192.241.222.118 DST=> Jan 08 15:34:55 skyhost-vds-22235 sshd[12840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22> Jan 08 15:34:57 skyhost-vds-22235 sshd[12840]: Failed password for root from 221.181.185.198 port 27634 ssh2 Jan 08 15:34:59 skyhost-vds-22235 sshd[12840]: Failed password for root from 221.181.185.198 port 27634 ssh2 Jan 08 15:35:01 skyhost-vds-22235 sshd[12844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18> Jan 08 15:35:01 skyhost-vds-22235 CRON[12846]: pam_unix(cron:session): session opened for user root by (uid=0) Jan 08 15:35:01 skyhost-vds-22235 CRON[12847]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1) Jan 08 15:35:01 skyhost-vds-22235 CRON[12846]: pam_unix(cron:session): session closed for user root Jan 08 15:35:01 skyhost-vds-22235 sshd[12840]: Failed password for root from 221.181.185.198 port 27634 ssh2 Jan 08 15:35:02 skyhost-vds-22235 sshd[12840]: Received disconnect from 221.181.185.198 port 27634:11: [preauth] Jan 08 15:35:02 skyhost-vds-22235 sshd[12840]: Disconnected from authenticating user root 221.181.185.198 port 27634 [preauth] Jan 08 15:35:02 skyhost-vds-22235 sshd[12840]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.181.185> Jan 08 15:35:03 skyhost-vds-22235 sshd[12844]: Failed password for root from 181.49.50.202 port 47894 ssh2 Jan 08 15:35:04 skyhost-vds-22235 sshd[12844]: Received disconnect from 181.49.50.202 port 47894:11: Bye Bye [preauth] Jan 08 15:35:04 skyhost-vds-22235 sshd[12844]: Disconnected from authenticating user root 181.49.50.202 port 47894 [preauth] Jan 08 15:35:04 skyhost-vds-22235 sshd[12849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22> Jan 08 15:35:06 skyhost-vds-22235 sshd[12842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=11> Jan 08 15:35:06 skyhost-vds-22235 sshd[12849]: Failed password for root from 221.181.185.198 port 35303 ssh2 Jan 08 15:35:08 skyhost-vds-22235 sshd[12842]: Failed password for root from 116.1.149.196 port 33042 ssh2 lines 1017-1067/1067 (END)