Linked Questions

0
votes
2answers
238 views

Linux - Security - Is someone trying to find a way in? [duplicate]

Possible Duplicate: Hundreds of failed ssh logins Recently I have been spending more time on my production servers in efforts to puppetize several configs and I happened to issue a find ...
0
votes
2answers
76 views

Understanding Auth Logs on Ubuntu Server [duplicate]

I have a web application that I'm hosting on an Amazon Ubuntu server, and it has a public IP address - and very little traffic. I was observing the authorization logs in /var/log, and noticed several ...
27
votes
7answers
21k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
3
votes
7answers
3k views

Stealthed vs Closed Port

I was reading a website about the difference between stealthed and closed ports. http://www.grc.com/faq-shieldsup.htm A closed port will echo a packet if closed. However, a stealthed port will not ...
5
votes
5answers
15k views

SSH / SSHD - How do I set max login attempts?

What is the easiest way to setup max login attempts in a LAMP environment (sshd installed via yum)? Is there a package or simple firewall rule?
4
votes
2answers
8k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
8
votes
5answers
1k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
-1
votes
2answers
1k views

How can I reject all incoming UDP packets except for DNS lookups?

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I ...
1
vote
2answers
1k views

IP-dependent local port-forwarding on Linux

I have configured my server's sshd to listen on a non-standard port 42. However, at work I am behind a firewall/proxy, which only allow outgoing connections to ports 21, 22, 80 and 443. Consequently, ...
3
votes
3answers
453 views

iptables question

I am currently under an SSH attack. The attack is very strange in nature, the attacker is using a botnet of computers and using them as individual login attempts (see log snippet): Dec 11 08:30:51 ...
2
votes
4answers
395 views

Which iptables rule do you think is a 'must have'

I have some basic iptable rules set up now for my vps. Just block everything except some default ports, 80,21,22,443. I do get brute forced a lot. I have heard that iptables is very powerful but I ...
0
votes
2answers
505 views

SSH occasionally (rarely) doesn't connect

I've been running this script for a few days: while [ true ]; do ssh USER@SERVER echo -n . || date +"%s"; done Obviously, my terminal is filled with dots, but sometimes (quite rarely) I get this ...
0
votes
2answers
634 views

Apache DDOS Prevention

Moved from Stackoverflow. I have a LAMP server running Ubuntu with security programs such as Denyhosts, Fail2ban and with Mod_security installed but seem to constantly be the target of a DDOS attack. ...
1
vote
2answers
384 views

Throttle Logins to Linux System

How can I set login throttling and lockout policies on a Linux (specifically Debian) system? Things like, setting retry count, delays between login attempts, and idle session timeouts. The box in ...

15 30 50 per page