Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Since a lot of days, maybe, months, ago, one of my servers is crashing, almost everyday. Sometimes, more then once a day.![alt text][1]

That is worrying me a lot.

My lot at /vars/log/messages is full of lines like these below:

Oct  8 13:36:25 host kernel: Firewall: *TCP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=93.150.204.152 DST=00.000.000.000 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=33286 DF PROTO=TCP SPT=4957 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 
Oct  8 13:36:25 host kernel: Firewall: *TCP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=93.150.204.152 DST=00.000.000.000 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=14135 DF PROTO=TCP SPT=4959 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 
Oct  8 13:36:25 host kernel: Firewall: *TCP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=93.150.204.152 DST=00.000.000.000 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=63643 DF PROTO=TCP SPT=4958 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 
Oct  8 13:36:26 host kernel: Firewall: *TCP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=93.150.204.152 DST=00.000.000.000 LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=4301 DF PROTO=TCP SPT=4960 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0 
Oct  8 13:39:10 host kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=218.30.22.82 DST=00.000.000.000 LEN=404 TOS=0x00 PREC=0x00 TTL=116 ID=34607 PROTO=UDP SPT=1271 DPT=1434 LEN=384 
Oct  8 13:40:14 host kernel: Firewall: *TCP_IN Blocked* IN=eth1 OUT= MAC=00:30:48:63:3b:5d:00:1b:0d:ec:8e:40:08:00 SRC=119.152.144.40 DST=00.000.000.000 LEN=56 TOS=0x00 PREC=0x00 TTL=49 ID=23737 DF PROTO=TCP SPT=2435 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0 

Note that I replace my server's IP by 00.000.000.000.

I aways get a lot or log messages about brute force attack. Failed login attemps...

Can someone give me some Idea, about what to do to solve this problem?

I already have CSF and DDOS deflate installed. But they are not solving the problem.

My server is Cent OS, Apache2

share|improve this question
    
Crashes can also be symptomatic of a system compromise. Start thinking about what is not being blocked by the firewall and look there. –  Scott Pack Oct 8 '10 at 20:46
add comment

2 Answers

It looks like someone is trying to connect via telnet (DPT=23) and SQL(DPT=1434) ports, these REALLY should not be exposed to the internet. I would completly filter them at the firewall. That should at least clean up your logs if the server keeps crashing you can try and see if it is something else.

share|improve this answer
1  
I believe that UDP protocol on port 1434 would be the SQL Server Browser. –  jl. Oct 8 '10 at 21:42
add comment

As they are block these connections are not harmful for a DDOS. Logs are only there to let you know who tried to attack you. What is harmful is when the number of half connection opened gets near the limit you specified in your config. What I suggest you is to follow the advice of Zypher and have your firewall to moderate these connections.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.