私用 vps 被 hack， 请教 log 含义

[qanniu]

请教各位大大， 自己私用的搬瓦工搭建$$, 多次发现如下 log， 不太明白是什么意思，请教各位大大，该如何预防。

Reason: Network abuse: Many outgoing SSH sessions More details: We have detected an unusually high number of SSH sessions originating from > this server. This usually means that the server is involved in a brute-force attack. Additional information:

**********************************************
List of processes
**********************************************
122121     systemd-udevd    /lib/systemd/systemd-udevd --daemon
132708     sshd             /usr/sbin/sshd -D
194824     supervisord      /usr/bin/python /usr/local/bin/supervisord -c /etc/supervisor/supervisord.conf -j /var/run/supervisord.pid
195651     server_linux_38  /usr/local/kcptun/server_linux_386 -c /usr/local/kcptun/server-config.json
535976     upstart-file-br  upstart-file-bridge --daemon
535994     upstart-socket-  upstart-socket-bridge --daemon
887616     ssserver         /usr/bin/python /usr/local/bin/ssserver -c ssconfig.json -d start
1020851    init             init
1020859    kthreadd/118173  
1020860    khelper/118173   
1022663    cron             cron


**********************************************
First 280 lines from conntrack table (truncated)
**********************************************
ipv4     2 tcp      6 43186 ESTABLISHED src=210.79.76.39 dst===MYIPADDR== sport=21916 dport=443 src===MYIPADDR== dst=210.79.76.39 sport=443 dport=21916 [ASSURED] mark=0 secmark=0 use=2
ipv4     2 tcp      6 43181 ESTABLISHED src===MYIPADDR== dst=210.79.76.39 sport=38164 dport=22 src=210.79.76.39 dst===MYIPADDR== sport=22 dport=38164 [ASSURED] mark=0 secmark=0 use=2
ipv4     2 tcp      6 119 TIME_WAIT src=210.79.76.39 dst===MYIPADDR== sport=22410 dport=443 src===MYIPADDR== dst=210.79.76.39 sport=443 dport=22410 [ASSURED] mark=0 secmark=0 use=2

[flyfishcn]

是说你的服务器发起了大量的 SSH 会话，可能是在攻击别人。
你现在提供的日志看不出什么。