檢查服務器是否被惡意登錄

Ubuntu

1. 查看近期成功的密碼登錄：

grep "password" /var/log/auth.log | grep -v Failed | grep -v Invalid

2. 查看最近登錄失敗的 IP 和每個 IP 失敗次數：

awk '{if($6=="Failed"&&$7=="password"){if($9=="invalid"){ips[$13]++;users[$11]++}else{users[$9]++;ips[$11]++}}}END{for(ip in ips){print ip, ips[ip]}}' /var/log/auth.log | sort -k2 -rn

3. 查看近期登錄失敗的用戶名和失敗次數：

awk '{if($6=="Failed"&&$7=="password"){if($9=="invalid"){ips[$13]++;users[$11]++}else{users[$9]++;ips[$11]++}}}END{for(user in users){print user, users[user]}}' /var/log/auth.log | sort -k2 -rn

CentOS

1. 查看成功登錄

grep "Accepted password for" /var/log/secure

2. 查看每個用戶名失敗的次數

grep "Failed password" /var/log/secure | awk '{if (NF==16){c[$11]++}else{c[$9]++}}END{for(u in c)print u,c[u]}' | sort -k 2 -nr | head

3. 查看每個 IP 地址失敗的次數

grep "Failed password" /var/log/secure | awk '{if (NF==16){c[$13]++}else{c[$11]++}}END{for(u in c)print u,c[u]}' | sort -k 1 -n | head