0
votes
2answers
329 views

Linux - Security - Is someone trying to find a way in? [duplicate]

Possible Duplicate: Hundreds of failed ssh logins Recently I have been spending more time on my production servers in efforts to puppetize several configs and I happened to issue a find ...
0
votes
2answers
134 views

Understanding Auth Logs on Ubuntu Server [duplicate]

I have a web application that I'm hosting on an Amazon Ubuntu server, and it has a public IP address - and very little traffic. I was observing the authorization logs in /var/log, and noticed several ...
36
votes
8answers
32k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
8
votes
5answers
29k views

SSH / SSHD - How do I set max login attempts?

What is the easiest way to setup max login attempts in a LAMP environment (sshd installed via yum)? Is there a package or simple firewall rule?
3
votes
7answers
5k views

Stealthed vs Closed Port

I was reading a website about the difference between stealthed and closed ports. http://www.grc.com/faq-shieldsup.htm A closed port will echo a packet if closed. However, a stealthed port will not ...
5
votes
2answers
12k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
8
votes
5answers
2k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
1
vote
4answers
2k views

How can I reject all incoming UDP packets except for DNS lookups?

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I ...
2
votes
2answers
2k views

IP-dependent local port-forwarding on Linux

I have configured my server's sshd to listen on a non-standard port 42. However, at work I am behind a firewall/proxy, which only allow outgoing connections to ports 21, 22, 80 and 443. Consequently, ...
3
votes
3answers
462 views

iptables question

I am currently under an SSH attack. The attack is very strange in nature, the attacker is using a botnet of computers and using them as individual login attempts (see log snippet): Dec 11 08:30:51 ...
2
votes
4answers
429 views

Which iptables rule do you think is a 'must have'

I have some basic iptable rules set up now for my vps. Just block everything except some default ports, 80,21,22,443. I do get brute forced a lot. I have heard that iptables is very powerful but I ...
1
vote
2answers
816 views

SSH occasionally (rarely) doesn't connect

I've been running this script for a few days: while [ true ]; do ssh USER@SERVER echo -n . || date +"%s"; done Obviously, my terminal is filled with dots, but sometimes (quite rarely) I get this ...
1
vote
2answers
581 views

Throttle Logins to Linux System

How can I set login throttling and lockout policies on a Linux (specifically Debian) system? Things like, setting retry count, delays between login attempts, and idle session timeouts. The box in ...
-1
votes
2answers
893 views

Apache DDOS Prevention

Moved from Stackoverflow. I have a LAMP server running Ubuntu with security programs such as Denyhosts, Fail2ban and with Mod_security installed but seem to constantly be the target of a DDOS attack. ...
0
votes
2answers
237 views

IPTables only solution to block any IP address who has made too many connections or reconnections

I’m looking for an IPTables only solution to block any IP address who has made too many (e.g. more than 5) connections or reconnections within a short period of time (e.g. 1 minutes) on a certain ...

15 30 50 per page