내 컴퓨터가 오늘부터 녹음을 중단했습니다 06:54:07.
$ journalctl --verify
24af830: Invalid data object at hash entry 4203 of 233016
File corruption detected at /var/log/journal/32d0d5fb253f44a692fd0e09b4893fe2/system.journal:24af6b0 (of 41943040 bytes, 91%).
FAIL: /var/log/journal/32d0d5fb253f44a692fd0e09b4893fe2/system.journal (Bad message)
명령 출력의 일부 journalctl --boot=-2 -r:
Jul 17 06:44:40 asdf sshd[7661]: ^[[0;1;39mPAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.5.7 user=root
Jul 17 06:44:40 asdf sshd[7661]: Disconnected from 10.0.5.7 port 41364 [preauth]
Jul 17 06:44:40 asdf sshd[7661]: Received disconnect from 10.0.5.7 port 41364:11: [preauth]
Jul 17 06:44:40 asdf sshd[7661]: Failed password for root from 10.0.5.7 port 41364 ssh2
Jul 17 06:44:38 asdf sshd[7661]: pam_tally(sshd:auth): Tally overflowed for user root
Jul 17 06:44:37 asdf sshd[7661]: Failed password for root from 10.0.5.7 port 41364 ssh2
Jul 17 06:44:36 asdf sshd[7661]: ^[[0;1;39mpam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.5.7 user=root
Jul 17 06:44:36 asdf sshd[7661]: pam_tally(sshd:auth): Tally overflowed for user root
Jul 17 06:44:34 asdf sshd[7658]: ^[[0;1;39mPAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.5.7 user=root
Jul 17 06:44:34 asdf sshd[7658]: Disconnected from 10.0.5.7 port 33277 [preauth]
Jul 17 06:44:34 asdf sshd[7658]: Received disconnect from 10.0.5.7 port 33277:11: [preauth]
Jul 17 06:44:34 asdf sshd[7658]: Failed password for root from 10.0.5.7 port 33277 ssh2
Jul 17 06:44:32 asdf sshd[7658]: pam_tally(sshd:auth): Tally overflowed for user root
Jul 17 06:44:32 asdf sshd[7658]: Failed password for root from 10.0.5.7 port 33277 ssh2
Jul 17 06:44:29 asdf sshd[7658]: pam_tally(sshd:auth): Tally overflowed for user root
Jul 17 06:44:29 asdf sshd[7658]: Failed password for root from 10.0.5.7 port 33277 ssh2
Jul 17 06:44:27 asdf sshd[7658]: ^[[0;1;39mpam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.5.7 user=root
Jul 17 06:44:27 asdf sshd[7658]: pam_tally(sshd:auth): Tally overflowed for user root
Jul 17 06:44:25 asdf sshd[7656]: ^[[0;1;39mPAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.5.7 user=root
Jul 17 06:44:25 asdf sshd[7656]: Disconnected from 10.0.5.7 port 36290 [preauth]
Jul 17 06:44:25 asdf sshd[7656]: Received disconnect from 10.0.5.7 port 36290:11: [preauth]
Jul 17 06:44:25 asdf sshd[7656]: Failed password for root from 10.0.5.7 port 36290 ssh2
Jul 17 06:44:24 asdf sshd[7656]: pam_tally(sshd:auth): Tally overflowed for user root
그 후 컴퓨터가 다시 시작되었습니다.
문제는 다음과 같습니다
내 컴퓨터가 손상되었나요? 그렇다면 내 컴퓨터에 연결하려는 모든 사람이 해당 IP(10.0.5.7)를 이미 사용하고 있기 때문에(네트워크 관리자에 의해 NAT됨) 앞으로 이런 일이 다시 발생하지 않도록 하려면 어떻게 해야 합니까
fail2ban?sshguard로그를 수정하는 방법은 무엇입니까? 손상된 파일을 다른 디렉토리로 옮겼습니다. 진단을 위해 손상된 로그를 읽는 방법은 무엇입니까?