Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Fairly new at securing and monitoring Linux boxes but have noticed some odd behaviour with our locally hosted LAMP server that stores our disaster recovery. Basically it has been reporting itself as being offline periodically and then comes back. Apache2 logs show some "graceful shutdowns" while the auth.log is showing the following:

Aug  1 09:39:01 ****** CRON[10907]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug  1 09:39:01 ******** CRON[10907]: pam_unix(cron:session): session closed for user root
Aug  1 09:48:24 ******* sshd[10917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=helpdesk.**********.***  user=root
Aug  1 09:48:26 ******** sshd[10917]: Failed password for root from 10.168.50.3 port 3831 ssh2
Aug  1 10:09:01 ********* CRON[10921]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug  1 10:09:01 ******** CRON[10921]: pam_unix(cron:session): session closed for user root
Aug  1 10:17:01 ********* CRON[10931]: pam_unix(cron:session): session opened for user root by (uid=0)

Am I correct in assuming the the failed password from root entries are some system trying to access the box via ssh? Annoyingly it is a system within our network. Aslo is there any reason for Apache2 to periodically shutdown "gracefully"? Would it do this to clear cache etc?

share|improve this question
1  
It is common for your daily log rotation scripts to restart Apache in order to close the open log files. –  larsks Aug 3 '11 at 18:47
    
Thats nice to know and ease some of my concerns. The other bit of the failed auth attempts though; are these excusable or are they more likely to be an attempt to gain access to the system (I am the only one responsible for the server and only one with credentials or reason to use it(. –  Tim Alexander Aug 4 '11 at 8:31

1 Answer 1

up vote 1 down vote accepted

Moving this from the comments...

Apache restarts

It is common for your daily log rotation scripts to restart Apache in order to close the open log files. If the restart correspond to entries in cron (typically in /etc/crontab, /etc/cron.d, or /etc/cron.daily), then you can be pretty sure this is what's happening. This might be controlled by a daily call to logrotate, which is configured via /etc/logrotate.conf and /etc/logrotate.d.

Note that some of these paths may be distribution specific.

SSH access attempts

Any system with an ssh port opened to the world is going to see a lot of failed ssh attempts because there are people all over the place running probes to find vulnerable systems.

However, you've identified the connections as coming from inside your network, so the first thing to do would be contact the person responsible for the originating system and see what's going on. It could be something legitimate like a security scanner, or it could be a compromised system.

I'm venturing into personal opinion here, but if you allow password authentication to your system you're setting yourself up for trouble at some point. The safest way to configure ssh is to simply disable password authentication in your sshd configuration and rely exclusively on key-based authentication for access. By doing this you eliminate the risk posed by brute-force password attempts, and you mitigate a variety of other problems, as well. An attacker cannot use a password captured via other means to access the system, and a successful attack via other means cannot be used to harvest passwords by installing a trojan ssh server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.