Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Lately my server goes down many times and I have to reboot it in order to start up again.

I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected in service log from IP(s) 195.110.154.68

enter image description here

This is kind of getting really annoying and felt that my server is not in a good position.

I really don't have much control on my server at the moment because the person who set up the server not able to give me the root password of my server at the moment because he is out of the country.

What can I do to prevent this?

Or the only option is to wait for root password and install some protection script?

EDIT: Seriously at the moment I post my server went down again!

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.

as far as root goes, make sure to disable root remote logins w/ "PermitRootLogin no" in your sshd_config

share|improve this answer
1  
your last line is critical! –  tony roth Apr 18 '12 at 19:20
1  
Ali, start with manually filtering that IP using firewall rules (iptables) –  alexus Apr 18 '12 at 19:22
add comment

You have a limited amount of choices without root access. You will have to rely on blocking IPs on your external firewall or setting up an IPS sensor in front of it to filter the traffic prior to reaching the server, such as Snort mentioned above. However, once you do get root access, I would highly recommend using fail2ban on your server. It will do a good job of locking out IPs try to attack your website.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.