DigitalOcean 发了一个 Ticket 说 SNMP 攻击

[zzy8200]

用的是CENTOS，<del>记忆中根本没开过SNMP。</del>. 用监控宝开了SNMP.但是有用户名和强密码的。这种情况怎么处理

Please review the following abuse complaint and provide us with a resolution:

---

You appear to be running an open SNMP server at IP address X.X.X.X that participated in an attack against a customer of ours, generating large UDP responses to spoofed queries, with those responses becoming fragmented because of their size.

Please consider reconfiguring your SNMP-speaking device in one or more of these ways:

• Block queries made by unauthorized addresses. This can be done with an ACL or other firewall rule.
• Use a different query string than "public" and which cannot be easily guessed by a 3rd party.
• Disable SNMP entirely.

If you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack.

Example SNMP responses sent to us by your device during the attack are given below.
Date/timestamps (far left) are UTC.

2015-03-17 19:54:53.942696 IP (tos 0x0, ttl 55, id 0, offset 0, flags [DF], proto UDP (17), length 1213) X.X.X.X > 31.186.250.x.3389: UDP, length 1185
0x0000: 4500 04bd 0000 4000 3711 2c46 68ec 8f74 [email protected].,Fh..t

(The final octet of our customer's IP address is masked in the above output because some automatic parsers become confused when multiple IP addresses are included. The value of that octet is "207".)

-John
President
Nuclearfallout, Enterprises, Inc. (NFOservers.com)

(We're sending out so many of these notices, and seeing so many auto-responses, that we can't go through this email inbox effectively. If you have follow-up questions, please contact us at [email protected].)

---

Please note that generating multiple abuse complaints in a short period of time may lead to your account being suspended.

[Showfom]

关闭 snmp 服务即可

[zzy8200]

@Showfom 已经配置好了，开SNMP是给监控宝用的，发现没关public

[Showfom]

@zzy8200 恩 然后你解释一下关掉即可