Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm kind of confused right now recently my friend who also take care of the server got an email from the DirectAdmin say that we got Brute-Attack with one of the IP from Italy, but I didn't get a chance to look at the scree.

Our Virtualbox run on Xserver and everytime now when my server down is because it crashes, so I wonder if that because our server got Brute-Attack?

My friend told me that it might be from one of hater from other website who is trying to get our website down.

How can I check the log or to prevent from this to keep happening?

We are running CentOS 5

Thanks

share|improve this question
1  
possible duplicate of My server's been hacked EMERGENCY –  MDMarra Apr 19 '12 at 14:20

1 Answer 1

up vote 1 down vote accepted

Depends on what you mean when you're talking about your brute force attack.

If you are talking about your web server getting brute forced (someone is guessing passwords in a methodical manner) you just check your web server's logs. You don't say what you're running but it should have logs of page accesses. See what IP is constantly hitting the same login page. It's probably under /var/log/ somewhere.

If you really mean you're being denial of serviced, check your logs again, or check your router/firewall logs. When you find the constant stream of IP's, block it at the ingress point on your firewall.

If it's saturating your bandwidth, contact your upstream provider and have that IP blocked farther up the connection, and relieve the stress on your connection.

Gather some statistics programs for analyzing your web server logs and see what they reveal in your traffic patterns.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.