Hacking attempts on server

[tonygeor]

This is for members who have a web hosting accounts. My server informs me whenever theirs been an attempt to access root. I get about 8 emails a day of random ips (mostly in china) trying to gain access. Is this typical?

 

[Iron Woode]

the proper place to post this would be in the Security forum. You will get better responses than OT.

 

[Crusty]

I'm surprised it's that low.

Things you can do to lower your risk

1) Change SSH ports
2) Disable ROOT logins via SSH
3) Require public/private keys + passphrase for login
4) Install fail2ban
5) Use port knocking

 

[Gooberlx2]

I'm surprised it's that low.

Same.

But yeah, definitely normal OP.

 

[Platypus]

I'm surprised it's that low.

Definitely. Harden your server up and just keep an eye on it.

 

[ViviTheMage]

Shit, you only get 8 attempts?

We get thousands.

 

[Lean L]

Lol that's very typical. When I ran FTP on my server I had thousands of hack attempts. Most were brute force things with default passwords and user names. I ended up setting up autobans when there were more then 5 attempts from the same ip and I still had hundreds of new ips lol... All this was just for a private server hosted from a residential line lol. Now I just use apache with no online config options for anything and no dynamic scripting lol. Do everything over VPN for security.

 

[tonygeor]

Right now the firewall seems to be doing a descent job from what i can tell. Once the Ip tries to login 5 times it is permanently blocked. Also if anyone ever gains root I get an email. I just think its pretty messed up that theirs all these groups scouring the internet just to find an open door.

 

[ViviTheMage]

We blocked South America once .. attempts went way down.

 

[rudeguy]

hi tony!

First post a year after registering? You have some mighty fine restraint.

Pics of your sister?

 

[rudeguy]

We blocked South America once .. attempts went way down.

I taught lil rudeguy how to ban Canada on his server. I've never seen him so happy.

 

[Pardus]

Shit, you only get 8 attempts?

We get thousands.

This.

 

[Lean L]

Right now the firewall seems to be doing a descent job from what i can tell. Once the Ip tries to login 5 times it is permanently blocked. Also if anyone ever gains root I get an email. I just think its pretty messed up that theirs all these groups scouring the internet just to find an open door.

Set up VPN if you can. take the server out of the dmz and only forward the ports you need to access http/https/whatever the fuck else. Open SSH is a disaster imvao.

 

[ViviTheMage]

I taught lil rudeguy how to ban Canada on his server. I've never seen him so happy.

LOL, who needs Canada anyway :awe:

 

[tonygeor]

hi tony!

First post a year after registering? You have some mighty fine restraint.

Pics of your sister?

It's been a busy 3 years for me. Joined the Army, went to iraq, came back from the sand pit, now getting out

 

[ViviTheMage]

It's been a busy 3 years for me. Joined the Army, went to iraq, came back from the sand pit, now getting out

Thanks :thumbsup:

 

[tonygeor]

Thanks :thumbsup:

It's cool, just glad I'm getting out and getting back into the tech world

 

[ViviTheMage]

In and out in a year? Or are you still "in" just not deployed? Did you do anything tech related while in?

 

[manlymatt83]

I'm surprised it's that low.

Things you can do to lower your risk

1) Change SSH ports
2) Disable ROOT logins via SSH
3) Require public/private keys + passphrase for login
4) Install fail2ban
5) Use port knocking

I wouldn't do #1. Security by obscurity is a bad habit to get into, in my opinion.

#2 sounds good.... /etc/ssh/sshd_config, PermitRootLogins No

#3 works well, but it could get annoying for you, especially if you login from different machines a lot.

#4 is the best choice, in my opinion. There's an easier way to do it with iptables (Linux) or pf (FreeBSD) that makes fail2ban not needed... I can post the one line ruleset if you'd like.

#5 is good, too.

 

[tonygeor]

I joined in 2007, signed up for 4 years...deployed in 2009 as a Military Intelligence Analyst (same job as that Manning dumbass). Came back after a year and now I'll be getting out in 2 months...w00t!

 

[ViviTheMage]

I joined in 2007, signed up for 4 years...deployed in 2009 as a Military Intelligence Analyst (same job as that Manning dumbass). Came back after a year and now I'll be getting out in 2 months...w00t!

Hell yeah, you going to school now?

 

[tonygeor]

#4 is the best choice, in my opinion. There's an easier way to do it with iptables (Linux) or pf (FreeBSD) that makes fail2ban not needed... I can post the one line ruleset if you'd like.

Lay it on me, thought I think the firewall has been doing a good job. It's always good to learn something new

 

[manlymatt83]

Lay it on me, thought I think the firewall has been doing a good job. It's always good to learn something new

What OS? What distro?

 

[tonygeor]

Hell yeah, you going to school now?

I already have a BS in computer science. I'm trying to start my own business so we'll see how my website and app work out.

 

[tonygeor]

What OS? What distro?

I know its a linux box using cpanel vps...my hosting provider is Servint (they've been awesome)