Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In addition to my day job as a technical support specialist, I operate a shared web hosting environment and run a number of servers for this purpose. I run a LAMP environment.

Beginning at 4am Eastern Time today, my firewall has alerted me to numerous port scans being performed on my server. When they didn't stop, I lowered the amount of port scans allowed before blocking the IP address outright for a set amount of time - and I increased the time limit (from 3600 seconds to 6900 seconds).

The scans just keep coming - and my firewall keeps blocking the IP addresses. Now, I'm beginning to consider blocking about 3 or 4 different Class B subnets.

I also remembered that I had Telnet installed, so because it's not doing anything useful, I went ahead and removed it. As of about a week or so ago, I have all security updates installed, although I do have some packages that have some outstanding non-security updates available.

How worried should I be that whoever this is is going to follow up these port scans with an attempted attack? Would you recommend I outright block these Class B subnets?

Edit: I should mention, of course, that I'm keeping a very close eye on my logs right now.

share|improve this question
Classful subnetting went away a long time ago. Just sayin'. Refer to your subnets with CIDR notation and you'll increase your geek cred. – EEAA Jul 21 '11 at 17:33
up vote 5 down vote accepted

You have a server on the public internet. It is going to get scanned and you are going to be subject to brute force attacks, denial of service, etc.

All you can do is make sure you do your due diligence and make sure your server is adequately secured. A few ideas:

  • turn off SSH password authentication in lieu of PKI auth
  • use iptables to filter ingress and egress traffic to only what you specifically need
  • ensure that any applications you have listening are up-to-date with regards to security patches
  • if you develop any of your own applications, make sure the don't have any SQL injection vulnerabilities
  • ship your logs off to another machine - in the event of a security breach, this is essential for forensic analysis
share|improve this answer
Fair enough! And based on your comments, looks like I have a good start. :) The idea to copy the logs off to another server is a good one. It completely makes sense, although I've never actually thought about that before. My lunch break is coming to a close, so that change will be made this evening. – David W Jul 21 '11 at 17:49
Additionally, I must add (and please don't take offense at this - we all started somewhere), it sounds like you may be a bit out of your depth here. You had telnet enabled, which honestly has been a huge no-no for many years. Since you thought it would be a good idea to turn on telnet at some point, it's likely there are other glaring security issues lingering around. I'm not sure if you already have paying customers yet. If you do, I'd consider not accepting any more until you get a bit more experience being a linux sysadmin. – EEAA Jul 21 '11 at 17:51
Also fair enough. I've been aware that Telnet wasn't a good idea for a while, but obviously failed to turn it off. I don't claim to be the best linux sysadmin on the planet, but I do claim to learn more and more as time goes on. Thanks for the input. – David W Jul 22 '11 at 11:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.