Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using a linode virtual server. My machine is Ubuntu 10.04.

I got a ticket from Linode that they detected malicous activity coming from my server.

"We have detected your system with an IP of, , scanning a client we monitor. This was not a short attack but a prolonged scan and/or probe that was designed to find and intrude into the target network."

Now I'm hosting on linode to test an application, I have no idea how to manage and secure a server.

Please can someone give me some lead on how i should investigate the issue and how to solve it.

Thank you

share|improve this question
up vote 2 down vote accepted

If your server has been compromised then you should rebuild it from scratch, rather than waste too much time investigating how it was cracked. This may be easier on a virtual server.

Install both chkrootkit and rkhunter, and run them regularly as cron jobs.

Then google harden ubuntu

Also consider restricting access to your own ip address or subnet.

share|improve this answer
thank you. any more advice on how to prevent this in the future ? – Dany Y May 14 '12 at 15:35
No, there is a lot of material out there written by experts. But before concluding the worst, you might just ask your colleagues if they have run a port scan or used nmap. That might trigger the warning you have received. – ramruma May 14 '12 at 17:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.