Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Recommend an intrusion detection system (IDS/IPS), and are they worth it?

I have an Ubuntu VPS that I use for practice and deploying prototypes as I am a python developer.

I recently started teaching my self sys admin tasks, like installing OpenLDAP. I happened to turn off the ufw firewall for just a minute, and when I ran an netstat command, I saw a foreign ip connected to ssh that I traced to china. I'd like to know a few things:

1) Is there any good network intrusion detection software, such that if any IP that's outside a specific range connects to the VPN, I can be notified? -- I am thinking about scripting this, but I'm pretty sure there's something useful out there and I believe in the wisdom of crowds.

2) How did this person gain access to my server? Is it because my firewall was down? Or is it because they browsed my LDAP directory and from there figured out a way to connect (there was a clear text password in the tree but it wasn't one used by the server's sshd)?

share|improve this question

marked as duplicate by Michael Hampton, EEAA, quanta, Sirex, Chris S Sep 21 '12 at 5:03

This question was marked as an exact duplicate of an existing question.

Just because someone connected to your ssh server doesn't mean they successfully logged in. Check your logs. – Michael Hampton Sep 21 '12 at 1:36
What would the log entry say if there's a connection? And do I look in /var/log/syslog? Or is there an sshd log? – Sam Hammamy Sep 21 '12 at 1:42
@SamHammamy - you can easily figure that out for yourself. Just watch the logs as you start up a new ssh session and see what you see. You'll want to watch /var/log/auth.log. – EEAA Sep 21 '12 at 1:56
If you want something super simple that requires little effort to set up, check out csf (config server firewall) – Ben Lessani - Sonassi Sep 21 '12 at 7:18

Like most Linux distros, Ubuntu comes with TCP Wrapper, provided by the libwrap0 package, which will let you allow and deny access to selected services by the connecting party's IP address. You do this by editing the /etc/hosts.allow and /etc/hosts.deny files. Run man hosts_access and man hosts_options to read about how these files are configured.

When a client connects to your server, hosts.allow is looked at first to see if there is a rule that allows that client's IP address to connect to the given service. If there's no match then hosts.deny is looked at to see if there's a match. If neither match then access is granted for the client to connect to the service.

You can use this to your advantage in several ways.

Let's say you only wish for clients from 10.20.30/24 to connect to your server via SSH. You would add the following to /etc/hosts.allow.

sshd: 10.20.30.

Then in /etc/hosts.deny you would add:

sshd: ALL

These changes take effect the moment you save the file; there is no server process to restart.

If someone outside of the 10.20.30/24 subnet tried to connect to your server with ssh, not only would their connection fail but the attempt will be logged in /var/log/auth.log.

Sep 20 19:32:30 myserver sshd[6850]: refused connect from (

You could then use a program such as logwatch and configure it to email you reports of failed ssh connection attempts.

If setting up logwatch is more than you want to do, you can configure hosts.deny to run a program when a deny rule matches. This can be used to email you a message, log details to a file, or whatever. For example:

sshd: ALL: spawn /bin/echo "Failed ssh connection attempt from %h." | /usr/bin/mail -s %d-%h root

Don't forget to use a different service or keep a ssh connection open while you test this so you don't lock yourself out of your server.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.