记录服务器被入侵：ssh密码被更改、jar包启动失败自动kill、一直弹出You have new mail in /var/spool/mail/root

2024-04-08 10:16:15

问题现象：

ssh登录密码：无缘无故没人动服务器密码就被更改过，也向同事咨询过没人动过服务器，然后通过修改密码重新登录服务器。
jar包启动失败：启动jar包，随后不久直接被kill

[root@k8s-n4 discovery]# java -jar discovery-1.0.0.RELEASE.jar 

################################################
#                                              #
#        ## #   #    ## ### ### ##  ###        #
#       # # #   #   # #  #  # # # #  #         #
#       ### #   #   ###  #  # # ##   #         #
#       # # ### ### # #  #  ### # # ###        #
#                                              #
# Obfuscation by Allatori Obfuscator v6.4 DEMO #
#                                              #
#           http://www.allatori.com            #
#                                              #
################################################

2021-02-18 09:08:01.045  INFO 19907 --- [           main] s.c.a.AnnotationConfigApplicationContex: Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@1376c05c: artup date [Thu Feb 18 09:08:01 CST 2021]; root of context hierarchy
...
Killed

不断弹出You have new mail in /var/spool/mail/root：
查看这个的相关内容会发现一直有ERROR

|| ERROR || already running…

From root@k8s-n4.localdomain  Thu Feb 18 09:12:01 2021
Return-Path: <root@k8s-n4.localdomain>
X-Original-To: root
Delivered-To: root@k8s-n4.localdomain
Received: by k8s-n4.localdomain (Postfix, from userid 0)
	id 9ABDD43E1F; Thu, 18 Feb 2021 09:12:01 +0800 (CST)
From: "(Cron Daemon)" <root@k8s-n4.localdomain>
To: root@k8s-n4.localdomain
Subject: Cron <root@k8s-n4> /root/.sshd/sshd
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
Precedence: bulk
X-Cron-Env: <XDG_SESSION_ID=5360>
X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0>
X-Cron-Env: <LANG=en_US.UTF-8>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
Message-Id: <20210218011201.9ABDD43E1F@k8s-n4.localdomain>
Date: Thu, 18 Feb 2021 09:12:01 +0800 (CST)

||  ERROR  || already running...