Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently launched a website that's only been online 2 days, just checked the auth.log and already there are multiple login attempts being made from an IP based in Asia.

I've changed my own user accounts password to something more secure and now I'm concerned about the root account and having open ports?

Regarding the root account: Would it be a good idea to change the name of the root account to something completely random that only I would know? As most attempts are being made on the root user, having the username is half the battle won already? Is this a good or bad idea?

Regarding ports: Should I be closing ports for FTP and SSH and only opening them when I want to connect to the server myself, is this something that is normally done? Is there also any way of restricting SSH connections to a single IP and only allowing one connection at a time?

I'm not quite sure what the correct thing to do is, will appreciate any advice you can give!

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Would it be a good idea to change the name of the root account to something completely random that only I would know? As most attempts are being made on the root user, having the username is half the battle won already? Is this a good or bad idea?

For the OS, a much more secure solution would be to not allow root any SSH access at all. You should login as an unprivileged user that has the ability to su or sudo. Also all ssh access should be by private key, not passwords.

If you're interested in reducing the amount of traffic that comes through from these cracking attempts you can run ssh on a non standard port (this isn't a security measure, but it is an effective method of staying under the radar and keeping some unwanted traffic from ever hitting your machine).

Also, you can use a service like http://www.fail2ban.org/ that will monitor failed login attempts and ban IPs.

For application level access (things like CMSs etc) it's nice if you can stay away from default urls (like /admin or /administrator) and run off non-standard ports keeps you off the radar somewhat. Those don't increase security but once again can shift a lot of traffic away from those areas.

Security wise steering clear of default username (admin/root etc) and default passwords is a good idea. Also with CMS/Application logins, restricting I.P and using methods similar to fail2ban are a good idea.

Regarding ports: Should I be closing ports for FTP and SSH and only opening them when I want to connect to the server myself, is this something that is normally done? Is there also any way of restricting SSH connections to a single IP and only allowing one connection at a time?

  • Restricting access to specific IPs is a good idea
  • If you were paranoid you could open ports only when you needed to use them, however this could be inconvenient to implement
  • You can restrict access to the port SSH runs on through your firewall
  • You can restrict access to the SSH service via sshd_config, something like AllowUsers user@ip
share|improve this answer

Regarding the root account: Would it be a good idea to change the name of the root account to something completely random that only I would know? As most attempts are being made on the root user, having the username is half the battle won already? Is this a good or bad idea?

I think this is a bad idea, just forbid access for root account and use sudo/su instead

Should I be closing ports for FTP and SSH

first of all you should change default port 21/22, foe e.g. 2121/2222

and only opening them when I want to connect to the server myself, is this something that is normally done

yes, it's normal practice. You could try to use knock daemon

# yum info knock
Name        : knock
Arch        : x86_64
Version     : 0.5
Release     : 3.el6.rf
Size        : 33 k
Repo        : rpmforge
Summary     : Port-knocking server
URL         : http://www.zeroflux.org/knock/
License     : GPL
Description : knockd is a port-knock server. It listens to all traffic on an ethernet
            : interface, looking for special "knock" sequences of port-hits. A client
            : makes these port-hits by sending a TCP (or UDP) packet to a port on the
            : server. This port need not be open -- since knockd listens at the link-
            : layer level, it sees all traffic even if it's destined for a closed port.
            :
            : When the server detects a specific sequence of port-hits, it runs a
            : command defined in its configuration file. This can be used to open up
            : holes in a firewall for quick access.
share|improve this answer

I second Alex_hha's point: forbid logins as root. This means attackers have to guess/steal your user name AND your password, which is better than just guessing the root password. The other part I would add is to use ssh keys, because then they need to steal a file on your computer, which is hopefully more difficult than stealing a password from some badly protected web service. See Github's article about how to set up SSH keys:

https://help.github.com/articles/working-with-ssh-key-passphrases

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.