サーバー 攻撃されていたら

Question

firewallのログを見てみると以下のようなコードがたくさん出ているのですがこれはサーバー 攻撃されているログなんでしょうか？IPアドレスは自分のものではないです。

Jun 25 04:30:09 118-27-7-33 sshd[14945]: Failed password for root from 218.92.0.192 port 55053 ssh2
Jun 25 04:30:09 118-27-7-33 sshd[14945]: Failed password for root from 218.92.0.192 port 55053 ssh2
Jun 25 04:30:09 118-27-7-33 sshd[14945]: Failed password for root from 218.92.0.192 port 55053 ssh2
Jun 25 04:30:09 118-27-7-33 sshd[14945]: Received disconnect from 218.92.0.192 port 55053:11:  [preauth]
Jun 25 04:30:09 118-27-7-33 sshd[14945]: Disconnected from 218.92.0.192 port 55053 [preauth]
Jun 25 04:31:08 118-27-7-33 sshd[14948]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jun 25 04:31:09 118-27-7-33 sshd[14948]: Failed password for root from 218.92.0.192 port 58860 ssh2
Jun 25 04:31:09 118-27-7-33 sshd[14948]: Failed password for root from 218.92.0.192 port 58860 ssh2
Jun 25 04:31:09 118-27-7-33 sshd[14948]: Failed password for root from 218.92.0.192 port 58860 ssh2
Jun 25 04:31:09 118-27-7-33 sshd[14948]: Received disconnect from 218.92.0.192 port 58860:11:  [preauth]
Jun 25 04:31:09 118-27-7-33 sshd[14948]: Disconnected from 218.92.0.192 port 58860 [preauth]
Jun 25 04:32:10 118-27-7-33 sshd[14950]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jun 25 04:32:10 118-27-7-33 sshd[14950]: Failed password for root from 218.92.0.192 port 13310 ssh2
Jun 25 04:32:10 118-27-7-33 sshd[14950]: Failed password for root from 218.92.0.192 port 13310 ssh2
Jun 25 04:32:10 118-27-7-33 sshd[14950]: Failed password for root from 218.92.0.192 port 13310 ssh2
Jun 25 04:32:10 118-27-7-33 sshd[14950]: Received disconnect from 218.92.0.192 port 13310:11:  [preauth]
Jun 25 04:32:10 118-27-7-33 sshd[14950]: Disconnected from 218.92.0.192 port 13310 [preauth]
Jun 25 04:32:41 118-27-7-33 sshd[14952]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jun 25 04:32:42 118-27-7-33 sshd[14952]: Failed password for root from 222.186.31.166 port 44872 ssh2
Jun 25 04:32:42 118-27-7-33 sshd[14952]: Failed password for root from 222.186.31.166 port 44872 ssh2
Jun 25 04:32:42 118-27-7-33 sshd[14952]: Failed password for root from 222.186.31.166 port 44872 ssh2
Jun 25 04:32:43 118-27-7-33 sshd[14952]: Received disconnect from 222.186.31.166 port 44872:11:  [preauth]
Jun 25 04:32:43 118-27-7-33 sshd[14952]: Disconnected from 222.186.31.166 port 44872 [preauth]
Jun 25 04:32:43 118-27-7-33 sshd[14954]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jun 25 04:32:44 118-27-7-33 sshd[14954]: Failed password for root from 222.186.31.166 port 57206 ssh2
Jun 25 04:32:44 118-27-7-33 sshd[14954]: Failed password for root from 222.186.31.166 port 57206 ssh2
Jun 25 04:32:44 118-27-7-33 sshd[14954]: Failed password for root from 222.186.31.166 port 57206 ssh2
Jun 25 04:32:44 118-27-7-33 sshd[14954]: Received disconnect from 222.186.31.166 port 57206:11:  [preauth]
Jun 25 04:32:44 118-27-7-33 sshd[14954]: Disconnected from 222.186.31.166 port 57206 [preauth]
Jun 25 04:32:44 118-27-7-33 sshd[14956]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jun 25 04:32:46 118-27-7-33 sshd[14956]: Failed password for root from 222.186.31.166 port 19585 ssh2
Jun 25 04:32:46 118-27-7-33 sshd[14956]: Failed password for root from 222.186.31.166 port 19585 ssh2
Jun 25 04:32:46 118-27-7-33 sshd[14956]: Failed password for root from 222.186.31.166 port 19585 ssh2

Answer 1

攻撃ってほどでもないですが、なんかされてますね

Comments

[atage517]

本当ですか！このような文が数千行くらいあるんですけどこういうのはよくあることなんでしょうか？

[y_waiwai]

機械的にログインを試みてるだけのように思います
時間を見てるとそんなに頻繁ではないようですし、よくあることなんでしょうね

参考
https://cybersecurity-jp.com/cyber-terrorism/17426

[atage517]

アドバイスありがとうございました！