Is it normal to have many many lines in /var/log/kern.log about UFW block?
For example:
Aug 29 22:13:13 myvps kernel: [1980808.931708] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=9999 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 29 22:13:13 myvps kernel: [1980808.931742] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=8000 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 29 22:13:13 myvps kernel: [1980808.933696] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=60.173.8.240 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=106 ID=256 PROTO=TCP SPT=6000 DPT=9000 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 29 22:29:00 myvps kernel: [1981755.608423] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=124.232.142.220 DST=me LEN=59 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=UDP SPT=39150 DPT=53 LEN=39
Aug 29 22:32:41 vps91426 kernel: [1981977.005619] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=222.186.15.95 DST=me LEN=40 TOS=0x00 PREC=0x00 TTL=102 ID=256 PROTO=TCP SPT=6000 DPT=3306 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 29 22:39:55 myvps kernel: [1982410.798059] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=46.36.37.186 DST=me LEN=57 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=UDP SPT=52085 DPT=19 LEN=37
Aug 29 22:40:34 myvps kernel: [1982450.374159] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.122.1 DST=me LEN=164 TOS=0x00 PREC=0x00 TTL=53 ID=60675 DF PROTO=UDP SPT=53 DPT=47363 LEN=144
Aug 29 22:44:36 myvps kernel: [1982692.086596] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.121.3 DST=me LEN=92 TOS=0x00 PREC=0x00 TTL=59 ID=0 DF PROTO=UDP SPT=53 DPT=47363 LEN=72
Aug 29 22:46:35 myvps kernel: [1982810.854290] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=192.230.122.3 DST=me LEN=166 TOS=0x00 PREC=0x00 TTL=49 ID=37584 DF PROTO=UDP SPT=53 DPT=47363 LEN=146
etc etc..
How can I disallow this?
And also in /var/log/apache2/access.log I have lines:
212.224.87.174 - - [29/Aug/2014:17:35:28 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 415 "-" "-"
222.209.158.105 - - [28/Aug/2014:11:50:54 +0200] "GET http://hotel.qunar.com/render/hoteldiv.jsp?&__jscallback=XQScript_4 HTTP/1.1" 404 379 "http:// hotel.qunar.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36"
54.167.171.94 - - [28/Aug/2014:14:46:27 +0200] "HEAD / HTTP/1.1" 200 243 "-" "Cloud mapping experiment. Contact research@pdrlabs.net"
198.11.235.59 - - [28/Aug/2014:20:20:07 +0200] "HEAD / HTTP/1.0" 200 262 "-" "-"
115.29.140.19 - - [28/Aug/2014:20:53:14 +0200] "GET http://www.ly.com/ HTTP/1.1" 200 432 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0"
I'm afraid they're scanning the ports of my server and then to try to spam or something else..
I have installed:
Fail2ban, UFW (disallow all ports except FTP 21, 80, SSH with port changed and port Webmin) or better IPtables?, PSAD, disabled root and enabled private and public keys, changed port SSH (and denied port 22 with UFW).
In Fail2ban I have added rule apache-w00tw00t:
[apache-w00tw00t]
enabled = true
port = http,https
filter = apache-w00tw00t
action = iptables[name=Apache-w00tw00t,port=80,protocol=tcp]
mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]
logpath = /var/log/apache2*/access*.log
maxretry = 1
bantime = 86400
but maybe doesn't work..
mod_security was not able to install it, it gave me errors.
There are other modules to install to have a good security on server? or a programm "all in one"? for Debian 7
Thank you very much in advance
