Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I launched keep launching EC2 instances and for some reason i keep getting this email and then the server amazon shuts the server down...How do i restrict access to the port in question...

here is my email

We have detected that your instance(s):


have been behaving in the following way that is against our AWS Customer Agreement:

Port Scanning

Please be aware that in terms of the Web Services License Agreement if your instance(s) continue such abusive behavior, your account may be subject to termination.

EC2 has taken the following administrative action(s) against your instance(s):


It may be possible that you are not hosting this yourself, but your environment may have been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured against attack. Furthermore, you should:

  • Restrict access to specific and required ports and source addresses using the ’ec2-authorize’ command.
share|improve this question
up vote 2 down vote accepted

You can use simple iptable rule for this.

iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -p udp --dport 22 -j DROP

The above commands will block inbound connections on port 22 both TCP and UDP.

share|improve this answer
i got this error iptables -A INPUT -s --dport 22 -j DROP iptables v1.4.4: unknown option --dport' Try iptables -h' or 'iptables --help' for more information. – Matt May 6 '11 at 0:53
It's probably not supported by your version of iptables. You can try to replace --dport to --destination-port – Viktor Stískala May 6 '11 at 0:57
here is the new error...iptables -A INPUT -s --destination-port 22 -j DROP iptables v1.4.4: unknown option --destination-port' Try iptables -h' or 'iptables --help' for more information. – Matt May 6 '11 at 1:01
thanks again for all your help – Matt May 6 '11 at 1:01
I've changed the above commands. Hope that it will work now. – Viktor Stískala May 6 '11 at 1:05

It looks like amazon thinks that you are running port scans from your instance, if you are not (and from the sound of it doesnt sound like you are) then there is a possbility that your box has been compromised and is being used to stage attacks to other servers.

Use the last command to see if you notice any strange logins, check out /var/log/auth.log. use the top command to see if there are any unknown processes running.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.