Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is CSF/LFD pretty much my best defense already?

Screenshot of inbox

share|improve this question
    
It is the life of all shared VPS. Publicly known IP address blocks that are well documented with the script kiddies. Block it and move on. –  Tim Dec 20 '11 at 19:14
    
In our environment, we block ~93% of all incoming emails as spam. To-date... I've only ever had to pull out 2 emails in 5 years that were mis-tagged. Invest in a good anti-spam setup... and configure your server properly. That's really the best defense. –  TheCompWiz Dec 20 '11 at 19:31

2 Answers 2

up vote 1 down vote accepted

This is pretty common at VPS/dedicated server providers. Those networks are targets for bots and script kiddies.

My issue with LFD/CSF and similar tools is that these auto-blocks are really not necessary if you have good security in place.

I find that if you:

  • block everything not in use with your firewall
  • use good passwords
  • block direct root access
  • keep OS/web apps updates

Then these scans are more of an annoyance than a real attack.

I also find these auto-block tools create a sense of complacency. You see these emails as "normal" and miss significant threats.

My approach to this is not to alert or even not to auto-block at all. Rate-limiting firewall rules and good security practices render things like lfd unnecessary.

Recommendation

If you want to auto-block, I think you can configure CSF/LFD not to alert you.

In terms of alerts, I always ask myself. What do I do with this information? If you are not doing anything with the info, then probably don't need to see it. It will be logged should you need to review but little point in getting an email about a block that has already happened.

share|improve this answer

Yes, this is normal. Welcome to the internet. This looks like a log telling you that your server is already blocking them as they fail to guess a password in the first few attempts.

As you always should do, Make sure passwords are strong if they are required. Better is to use only ssh keys and not allow password logins. Consider not allowing root logins to ssh.

If you do these things you have little to worry about. You can run ssh on a non-standard port. It doesn't really get you any more security, especially if you doing things from the above paragraph, but you'd see a decline in the number of failures you are seeing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.