记录家里小nas一次被网络攻击的心得

风过留香 2026-08-14 17:35 1

家里的小盒子是一个华为的机顶盒，运营商送的，

刷了海纳思的系统，平常主要是pt下载，看看电影用的，

另外定时跑一些简单的python脚本，

下面是故事的正文。

出去玩了几天，回来出去玩了几天，回来后发现cpu的占用不太正常，平常一般在5%以内，现在在15%左右。

打开终端，在top里看到多个sshd进程的cpu占用较高，

top - 09:20:35 up 13 days, 16:33, 1 user, load average: 7.27, 6.84, 6.70

Tasks: 211 total, 2 running, 209 sleeping, 0 stopped, 0 zombie

%Cpu(s): 9.2 us, 5.2 sy, 0.0 ni, 85.6 id, 0.0 wa, 0.0 hi, 0.1 si, 0.0 st

MiB Mem : 928.1 total, 138.2 free, 410.8 used, 379.1 buff/cache

MiB Swap: 0.0 total, 0.0 free, 0.0 used. 467.6 avail Mem

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

32181 root 20 0 11324 5456 4604 S 7.9 0.6 0:00.24 sshd

32171 root 20 0 11324 5456 4604 S 5.0 0.6 0:00.22 sshd

5873 debian-+ 20 0 219708 145096 8748 S 3.6 15.3 579:08.41 transmiss+

32266 root 20 0 9220 4684 4092 S 1.7 0.5 0:00.05 sshd

2136 message+ 20 0 6640 3652 2608 S 1.3 0.4 78:02.23 dbus-daem+

25187 www-data 20 0 203428 17612 13708 S 1.3 1.9 0:01.63 php-fpm7.4

32147 root 20 0 9860 2420 2076 R 1.3 0.3 0:00.15 top

32160 sshd 20 0 9220 2956 2336 S 1.3 0.3 0:00.04 sshd

32173 sshd 20 0 9220 2968 2352 S 1.3 0.3 0:00.04 sshd

32182 sshd 20 0 9220 2976 2356 S 1.3 0.3 0:00.04 sshd

15354 shairpo+ 20 0 131816 8952 7216 S 1.0 0.9 103:32.46 shairport+

7 root 20 0 0 0 0 R 0.7 0.0 38:13.79 rcu_sched

1312 root 19 -1 32176 4456 3264 S 0.7 0.5 27:20.60 systemd-j+

2165 root 20 0 7752 1496 1300 S 0.7 0.2 108:12.83 system-in+

25160 root 20 0 69696 32004 9132 S 0.7 3.4 146:41.33 nas-media+

1 root 20 0 34548 6760 4464 S 0.3 0.7 44:34.46 systemd

755 root 20 0 0 0 0 D 0.3 0.0 48:09.61 log_udisk+

打开系统探针，看到系统日志上有很多不正常的记录

[1180120.162911]IPVS: Creating netns size=920 id=5463

[1180123.451849]IPVS: Creating netns size=920 id=5464

[1180127.182695]IPVS: Creating netns size=920 id=5465

[1180130.808287]IPVS: Creating netns size=920 id=5466

[1180134.146460]IPVS: Creating netns size=920 id=5467

[1180137.713379]IPVS: Creating netns size=920 id=5468

[1180141.002576]IPVS: Creating netns size=920 id=5469

[1180144.368947]IPVS: Creating netns size=920 id=5470

[1180147.633079]IPVS: Creating netns size=920 id=5471

[1180151.285139]IPVS: Creating netns size=920 id=5472

[1180154.844667]IPVS: Creating netns size=920 id=5473

[1180158.135347]IPVS: Creating netns size=920 id=5474

[1180161.627679]IPVS: Creating netns size=920 id=5475

[1180165.211552]IPVS: Creating netns size=920 id=5476

[1180169.018088]IPVS: Creating netns size=920 id=5477

[1180172.606314]IPVS: Creating netns size=920 id=5478

[1180176.055916]IPVS: Creating netns size=920 id=5479

[1180179.397844]IPVS: Creating netns size=920 id=5480

[1180182.464897]IPVS: Creating netns size=920 id=5481

[1180186.267898]IPVS: Creating netns size=920 id=5482

[1180189.626823]IPVS: Creating netns size=920 id=5483

[1180193.413778]IPVS: Creating netns size=920 id=5484

[1180196.405582]IPVS: Creating netns size=920 id=5485

[1180199.807499]IPVS: Creating netns size=920 id=5486

[1180203.634362]IPVS: Creating netns size=920 id=5487

[1180207.007687]IPVS: Creating netns size=920 id=5488

[1180211.132149]IPVS: Creating netns size=920 id=5489

[1180214.899165]IPVS: Creating netns size=920 id=5490

[1180217.753984]IPVS: Creating netns size=920 id=5491

[1180221.368701]IPVS: Creating netns size=920 id=5492

[1180224.523024]IPVS: Creating netns size=920 id=5493

[1180228.101610]IPVS: Creating netns size=920 id=5494

[1180230.906521]IPVS: Creating netns size=920 id=5495

[1180234.969385]IPVS: Creating netns size=920 id=5496

[1180238.570366]IPVS: Creating netns size=920 id=5497

[1180241.402126]IPVS: Creating netns size=920 id=5498

[1180245.329313]IPVS: Creating netns size=920 id=5499

[1180248.790780]IPVS: Creating netns size=920 id=5500

[1180252.648571]IPVS: Creating netns size=920 id=5501

[1180256.045716]IPVS: Creating netns size=920 id=5502

[1180258.998569]IPVS: Creating netns size=920 id=5503

[1180262.239930]IPVS: Creating netns size=920 id=5504

[1180265.031397]IPVS: Creating netns size=920 id=5505

[1180268.754977]IPVS: Creating netns size=920 id=5506

[1180271.687252]IPVS: Creating netns size=920 id=5507

[1180274.729095]IPVS: Creating netns size=920 id=5508

[1180277.517690]IPVS: Creating netns size=920 id=5509

[1180281.043712]IPVS: Creating netns size=920 id=5510

[1180284.447050]IPVS: Creating netns size=920 id=5511

[1180287.909744]IPVS: Creating netns size=920 id=5512

[1180291.165667]IPVS: Creating netns size=920 id=5513

[1180295.274329]IPVS: Creating netns size=920 id=5514

[1180298.595368]IPVS: Creating netns size=920 id=5515

[1180301.015300]IPVS: Creating netns size=920 id=5516

[1180304.690559]IPVS: Creating netns size=920 id=5517

[1180307.613428]IPVS: Creating netns size=920 id=5518

[1180310.931165]IPVS: Creating netns size=920 id=5519

[1180313.298922]IPVS: Creating netns size=920 id=5520

[1180316.752911]IPVS: Creating netns size=920 id=5521

[1180319.628780]IPVS: Creating netns size=920 id=5522

[1180322.956541]IPVS: Creating netns size=920 id=5523

[1180325.981695]IPVS: Creating netns size=920 id=5524

[1180329.421598]IPVS: Creating netns size=920 id=5525

[1180332.114483]IPVS: Creating netns size=920 id=5526

[1180335.167955]IPVS: Creating netns size=920 id=5527

[1180338.677824]IPVS: Creating netns size=920 id=5528

[1180342.230067]IPVS: Creating netns size=920 id=5529

[1180345.323062]IPVS: Creating netns size=920 id=5530

[1180348.878572]IPVS: Creating netns size=920 id=5531

[1180351.828499]IPVS: Creating netns size=920 id=5532

[1180355.163639]IPVS: Creating netns size=920 id=5533

[1180358.062944]IPVS: Creating netns size=920 id=5534

[1180362.044182]IPVS: Creating netns size=920 id=5535

[1180365.232462]IPVS: Creating netns size=920 id=5536

[1180368.200240]IPVS: Creating netns size=920 id=5537

[1180371.573120]IPVS: Creating netns size=920 id=5538

[1180374.348001]IPVS: Creating netns size=920 id=5539

[1180377.529937]IPVS: Creating netns size=920 id=5540

[1180380.429480]IPVS: Creating netns size=920 id=5541

[1180383.742872]IPVS: Creating netns size=920 id=5542

[1180386.512668]IPVS: Creating netns size=920 id=5543

[1180389.688615]IPVS: Creating netns size=920 id=5544

[1180392.579104]IPVS: Creating netns size=920 id=5545

[1180396.220324]IPVS: Creating netns size=920 id=5546

[1180399.454701]IPVS: Creating netns size=920 id=5547

[1180403.038173]IPVS: Creating netns size=920 id=5548

[1180405.710104]IPVS: Creating netns size=920 id=5549

[1180406.950202]IPVS: Creating netns size=920 id=5550

[1180409.140689]IPVS: Creating netns size=920 id=5551

[1180412.097843]IPVS: Creating netns size=920 id=5552

[1180415.502802]IPVS: Creating netns size=920 id=5553

[1180418.962893]IPVS: Creating netns size=920 id=5554

[1180422.862554]IPVS: Creating netns size=920 id=5555

[1180426.285455]IPVS: Creating netns size=920 id=5556

[1180429.579635]IPVS: Creating netns size=920 id=5557

[1180433.297123]IPVS: Creating netns size=920 id=5558

[1180436.217166]IPVS: Creating netns size=920 id=5559

[1180439.929405]IPVS: Creating netns size=920 id=5560

[1180443.332007]IPVS: Creating netns size=920 id=5561

[1180446.288869]IPVS: Creating netns size=920 id=5562

意识到系统正在遭受猛烈攻击，平均每3-4秒创建一个新的网络命名空间，

这是典型的分布式暴力破解攻击特征，攻击者在：

1、不断更换IP地址（通过创建新的netns）

2、尝试不同的用户名/密码组合

3、试图绕过防火墙限制

通过查询发现大量国外ip在连接ssh的22端口。

root@hi3798mv100:~# sudo netstat -tnpa | grep ':22 ’

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2303/sshd: /usr/sbi

tcp 0 0 192.168.1.3:22 110.173.190.221:59836 ESTABLISHED 3218/sshd: root [pr

tcp 0 0 192.168.1.3:22 45.142.193.164:56364 ESTABLISHED 3196/sshd: [accepte

tcp 0 0 192.168.1.3:22 192.168.1.7:51611 ESTABLISHED 2736/sshd: root@not

tcp 0 0 192.168.1.3:22 45.142.193.164:44980 ESTABLISHED 3122/sshd: root [pr

tcp 0 64 192.168.1.3:22 192.168.1.7:51667 ESTABLISHED 2798/sshd: root@pts

tcp 0 52 192.168.1.3:22 110.173.190.221:59860 ESTABLISHED 3230/sshd: [accepte

tcp 0 0 192.168.1.3:22 45.142.193.164:47932 ESTABLISHED 3221/sshd: [accepte

tcp 0 0 192.168.1.3:22 110.173.190.221:59804 ESTABLISHED 3204/sshd: root [pr

tcp 0 0 192.168.1.3:22 45.142.193.164:53384 ESTABLISHED 3086/sshd: root [pr

tcp 0 0 192.168.1.3:22 45.142.193.164:36538 ESTABLISHED 3147/sshd: [accepte

tcp6 0 0 :::22 :::* LISTEN 2303/sshd: /usr/sbi

root@hi3798mv100:~# sudo netstat -tnpa | grep ESTABLISHED

tcp 0 0 192.168.1.3:111 81.19.216.107:53167 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:50396 ESTABLISHED 21421/smbd

tcp 0 0 192.168.1.3:111 89.37.172.142:50188 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 45.33.109.8:58278 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:33614 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:33624 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:445 192.168.1.7:50583 ESTABLISHED 28032/smbd

tcp 0 0 192.168.1.3:111 45.33.12.214:36206 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 45.33.12.122:40418 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 69.5.169.245:43617 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:64003 ESTABLISHED 31504/smbd

tcp 0 0 192.168.1.3:33628 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:33620 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 42 192.168.1.3:7681 192.168.1.7:56331 ESTABLISHED 2283/ttyd

tcp 0 0 192.168.1.3:445 192.168.1.7:50133 ESTABLISHED 10718/smbd

tcp 0 0 192.168.1.3:111 72.14.178.148:40245 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:49622 ESTABLISHED 6642/smbd

tcp 0 0 192.168.1.3:111 45.33.109.8:58273 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 69.5.169.230:58021 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:33636 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:111 69.5.169.15:36252 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 69.5.169.209:46225 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 45.33.12.214:36211 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:42972 223.193.44.135:443 ESTABLISHED 29783/rclone

tcp 0 0 192.168.1.3:445 192.168.1.7:49159 ESTABLISHED 22072/smbd

tcp 0 0 192.168.1.3:80 192.168.1.7:61434 ESTABLISHED 8371/nginx: worker

tcp 0 0 192.168.1.3:445 192.168.1.7:53777 ESTABLISHED 3850/smbd

tcp 0 0 192.168.1.3:111 45.33.14.5:49279 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:33618 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:111 69.5.169.188:54459 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:56666 123.139.248.9:16877 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:111 45.33.14.5:49280 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:111 45.33.109.8:58274 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:50136 ESTABLISHED 11718/smbd

tcp 0 0 192.168.1.3:33634 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:111 193.32.209.254:64482 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:51537 ESTABLISHED 2697/smbd

tcp 0 0 192.168.1.3:33630 104.17.153.215:443 ESTABLISHED 5873/transmission-d

tcp 0 0 192.168.1.3:445 192.168.1.7:50219 ESTABLISHED 16881/smbd

tcp 0 0 192.168.1.3:111 194.50.235.139:21784 ESTABLISHED 2060/rpcbind

tcp 0 0 192.168.1.3:445 192.168.1.7:49788 ESTABLISHED 26797/smbd

tcp 0 0 192.168.1.3:445 192.168.1.7:49394 ESTABLISHED 26830/smbd

tcp6 0 0 2408:8220:6a33^-^58795 2408:8220:9e12:d2:51414 ESTABLISHED 5873/transmission-d

tcp6 0 0 2408:8220:6a33^-^35714 2606:4700:3030::681:443 ESTABLISHED 5873/transmission-d

tcp6 0 0 2408:8220:6a33^-^54110 2606:4700:3032::ac4:443 ESTABLISHED 5873/transmission-d

但好在没有发现ssh除了本地ip外成功登录的记录，说明密码没有被破解。

发现有10几个外国ip在进行RPCbind 扫描，端口111

应对策略如下：

1、关闭RPCbind 和111端口

sudo systemctl stop rpcbind

sudo systemctl disable rpcbind

sudo iptables -A INPUT -p tcp --dport 111 -j DROP

sudo iptables -A INPUT -p udp --dport 111 -j DROP

2、更改ssh端口22为其他不常用的

3、改个更强的root密码，全数字不放心啊

改完重启，又关注了半个小时，发现还是有零星的攻击记录，但明显少了很多。

[1187590.747109]IPVS: Creating netns size=920 id=5565

[1187602.390013]IPVS: Creating netns size=920 id=5566

[1188213.017468]IPVS: Creating netns size=920 id=5567

[1188221.757152]IPVS: Creating netns size=920 id=5568

[1188232.298696]IPVS: Creating netns size=920 id=5569

[1188281.303100]IPVS: Creating netns size=920 id=5570

[1188302.976535]IPVS: Creating netns size=920 id=5571

[1188329.791320]IPVS: Creating netns size=920 id=5572

[1188350.719354]IPVS: Creating netns size=920 id=5573

[1188583.287798]IPVS: Creating netns size=920 id=5574

[1188591.928067]IPVS: Creating netns size=920 id=5575

[1188628.705282]IPVS: Creating netns size=920 id=5576

[1188734.496476]IPVS: Creating netns size=920 id=5577

[1190634.355193]IPVS: Creating netns size=920 id=5578

又通过/etc/hosts.deny封禁了几个ip，至此到现在已经过去几个小时了，再也没有出现新的攻击记录。

这是我第一次被暴力破解，之前一直觉得一个小盒子，不会有人无聊到攻击，

现在发现还是大意了，这可能跟我有公网ip有关，如果没有公网ip会安全很多。

另外sshd的默认配置/etc/ssh/sshd_config 很弱，

安全功能几乎都没有配置，建议每个人都配置一下，

惊心动魄的一下午，给新手做个参考，

高手也多给点指点，我也是没有经验，瞎摸索的，

有经验的大佬多指点指点安全方面的建议，让我们共同维护好这个小盒子。后发现cpu的占用不太正常，平常一般在5%以内，现在在15%左右。

打开终端，在top里看到多个sshd进程的cpu占用较高，

最新回复 (10)

慕容泠鸢 08-14 17:47

1楼

绝大多数情况一个强密码可以解决爆破,实在不行上秘钥对
lovesusu 08-14 17:50

2楼

一般都是自动化的攻击，扫到了服务就自动跑字典，最常规的就是改掉常用端口，不需要的服务不监听到0.0.0.0上
上界司命 08-14 17:50

3楼

家里的路由器不能过滤IP么？路由器设置不了的话也可以套层waf，我用的主路由是ikuai 端口映射的时候我把非本省IP全ban了。有些比较广的服务端口也ban外国ip
Atoz 03 08-14 17:52

4楼

可以放<div data-theme-scrollable="true"> </div> 里面，观感有点差
Taru 08-14 17:56

5楼

我所有机器ssh全部禁密码登录，只用密钥，这要能被爆破那该睡不着的就不是我了
AAEE86 08-14 18:11

6楼

家里nas外网访问还是设置下ip白名单吧，嫌麻烦可以设置成你所在城市的IP段
adtest 08-14 18:43

7楼

所有常见的端口不要使用默认端口，而且你那个22如果需要使用就随机一个端口就行比如2w以上的端口，如果不需要使用直接就关了
风过留香楼主 08-14 19:03

8楼

还不敢在路由器上直接这么操作，用的有pt啊
风过留香楼主 08-14 19:03

9楼

是啊，已经改了12位强密码，应该可以的
风过留香楼主 08-14 19:04

10楼

嗯嗯，我打算再做一个html，放在web，写上是个小盒子，高手求放过

* 帖子来源Linux.do

附近帖子

飞读

风过留香

主题数
1

帖子数
1

注册排名
3

随机推荐