0

Is it normal to have many many lines in /var/log/kern.log about UFW block?

For example:

Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=9999 WINDOW=16384 RES=0x00 SYN URGP=0

Aug 29 22:13:13 myvps kernel: [1980808.931742] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=8000 WINDOW=16384 RES=0x00 SYN URGP=0

Aug 29 22:13:13 myvps kernel: [1980808.933696] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=9000 WINDOW=16384 RES=0x00 SYN URGP=0

Aug 29 22:29:00 myvps kernel: [1981755.608423] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=124.232.142.220 DST=me LEN=59 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=UDP SPT=39150 DPT=53 LEN=39

Aug 29 22:32:41 vps91426 kernel: [1981977.005619] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=222.186.15.95 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=3306 WINDOW=16384 RES=0x00 SYN URGP=0

Aug 29 22:39:55 myvps kernel: [1982410.798059] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=46.36.37.186 DST=me LEN=57 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=UDP SPT=52085 DPT=19 LEN=37

Aug 29 22:40:34 myvps kernel: [1982450.374159] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.122.1 DST=me LEN=164 TOS=0x00 PREC=0x00 TTL=53 ID=60675 DF PROTO=UDP SPT=53 DPT=47363 LEN=144

Aug 29 22:44:36 myvps kernel: [1982692.086596] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.121.3 DST=me LEN=92 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=UDP SPT=53 DPT=47363 LEN=72

Aug 29 22:46:35 myvps kernel: [1982810.854290] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.122.3 DST=me LEN=166 TOS=0x00 PREC=0x00 TTL=49 ID=37584 DF PROTO=UDP SPT=53 DPT=47363 LEN=146

etc etc..

How can I disallow this?

And also in /var/log/apache2/access.log I have lines:

212.224.87.174 - - [29/Aug/2014:17:35:28 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 415 "-" "-"

222.209.158.105 - - [28/Aug/2014:11:50:54 +0200] "GET http://hotel.qunar.com/render/hoteldiv.jsp?&__jscallback=XQScript_4 HTTP/1.1" 404 379 "http:// hotel.qunar.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36"

54.167.171.94 - - [28/Aug/2014:14:46:27 +0200] "HEAD / HTTP/1.1" 200 243 "-" "Cloud mapping experiment. Contact research@pdrlabs.net"

198.11.235.59 - - [28/Aug/2014:20:20:07 +0200] "HEAD / HTTP/1.0" 200 262 "-" "-"

115.29.140.19 - - [28/Aug/2014:20:53:14 +0200] "GET http://www.ly.com/ HTTP/1.1" 200 432 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0"

I'm afraid they're scanning the ports of my server and then to try to spam or something else..

I have installed:

Fail2ban, UFW (disallow all ports except FTP 21, 80, SSH with port changed and port Webmin) or better IPtables?, PSAD, disabled root and enabled private and public keys, changed port SSH (and denied port 22 with UFW).

In Fail2ban I have added rule apache-w00tw00t:

[apache-w00tw00t]
enabled = true
port     = http,https
filter = apache-w00tw00t
action = iptables[name=Apache-w00tw00t,port=80,protocol=tcp]
     mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]
logpath = /var/log/apache2*/access*.log
maxretry = 1
bantime  = 86400

but maybe doesn't work..

mod_security was not able to install it, it gave me errors.

There are other modules to install to have a good security on server? or a programm "all in one"? for Debian 7

Thank you very much in advance

Improve this question
2
  • 4
    This is only normal if you're on the Internet.
    – Michael Hampton
    Aug 30, 2014 at 10:39
  • 1
    Thank you, so the logs are normal? There isn't a way to block spambots before they arrive on the server to scan ports? thank you again
    – Sefora
    Aug 30, 2014 at 10:42

1 Answer 1

Reset to default
0

Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=9999 WINDOW=16384 RES=0x00 SYN URGP=0

i see syn in the logs

The TCP Syn is DoS (Denial of Service) attack. It consumes resources on your Linux server. The attacker begin with the TCP connection handshake sending the SYN packet, and then never completing the process to open the connection. This results into massive half-open connections. The Linux kernel can block such attacks easily.

to see your current configuration

# cat /proc/sys/net/ipv4/tcp_syncookies

to enable tcp syn protection check this

Also,

lsof  | grep "9000 (LISTEN)"

command above should give you the information about which process uses the port.

to install lsof

sudo apt-get install lsof
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.