| 形态 | Received disconnect ... [preauth] / Connection closed by authenticating user |
|---|---|
| 观察 | preauth 断开频次与间隔 |
查看
查看
grep -E 'Received disconnect|Connection closed|Connection reset' /var/log/auth.log | tail -30固定间隔的高频 preauth 断开是自动化扫描的典型节奏。
SSH 断开原因与 preauth 行为判读
Received disconnect 与 Connection closed 提示会话结束方式：爆破工具常在预认证阶段批量断开，正常用户则多在认证后交互一段时间。
易错点
- 网络抖动也会产生 Connection reset，需结合时段与其他主机对比
- 断开发生在认证前后是判断意图的重要区别
数据来源与参考
- OpenSSH 手册（sshd 日志与 DISCONNECT 消息）