LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-31-2014, 11:34 AM   #1
siemaeniu500
Member
 
Registered: Sep 2012
Posts: 44

Rep: Reputation: Disabled
My server is under attack


hello,

I have got dedicated server hosted on ovh.

Some of enemies is attacking my server.
How i can block that?

There are netstat logs:
http://paste.ubuntu.com/8198342/
 
Old 08-31-2014, 12:22 PM   #2
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,284

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
You haven't given us very much in the way to go on here. What service is listening on 25565? Why do you suspect many connections to this port represents an attack? What other services are running? Do you think that the machine has been compromised? If so, is there evidence that the attackers have managed to get root access?

If there is a root compromise, you will need to disconnect it from the network, take images of the running processes, memory, and filesystems, and use them to performa root-cause analysis of how the server was compromised. You'll then need to reimage the server from a known-good backup (you do have backups, right?), close whatever hole(s) allowed the compromise and any others you might have come accross in your analysis, and finally reconnect the server to the network. Since this server is at a dedicated hosting site, to which you do not have physical access, this is a bit tricky, but it can be done. Usually, you want ask the hosting provider to reimage the server, and before starting any services (i.e. using a remote console or the like, which any providers now offer), you would use iptables to block all traffic except from your own IP until the new server is properly configued and hardened.

If, on the other hand, this is not a root compromise but just someone abusing some service you are running, you can block their IP easily using iptables. There are numerous iptables guides scattered around; a quick google should bring you to onw. However, the attacker(s) may simply try again from another IP, in which case you might be able to use something like fail2ban (if the app requires authentication) or OSSEC to dynamically block attack events. This is not necessarily a newbie task, but with a couple howtos it should be possible.

I'd also highly recommend reading through a few system compromise threads and the stickies over at LQ's security forums. There are some very experienced people there who know the right way to deal with security incidents. Their expertise is invaluable; use it.
 
Old 08-31-2014, 12:26 PM   #3
siemaeniu500
Member
 
Registered: Sep 2012
Posts: 44

Original Poster
Rep: Reputation: Disabled
I just blocked it thanks.

http://scr.hu/2bwq/jkg0b
 
Old 08-31-2014, 02:45 PM   #4
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,284

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Great. How do you know that you actually solved the problem and that no unauthorized access to your system was gained?
 
Old 08-31-2014, 05:01 PM   #5
keefaz
LQ Guru
 
Registered: Mar 2004
Distribution: Slackware
Posts: 5,388

Rep: Reputation: 408Reputation: 408Reputation: 408Reputation: 408Reputation: 408
Quote:
Originally Posted by siemaeniu500 View Post

Some of enemies is attacking my server.
You mean the creatures that come out at night?
 
Old 08-31-2014, 05:02 PM   #6
siemaeniu500
Member
 
Registered: Sep 2012
Posts: 44

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by keefaz View Post
You mean the creatures that come out at night?

Yes i mean that, sorry for my english :P
 
Old 08-31-2014, 07:42 PM   #7
LinuxSparkles
LQ Newbie
 
Registered: Aug 2014
Location: Austraila
Distribution: Ubuntu, Suse, CentOS
Posts: 6

Rep: Reputation: Disabled
Minecraft server

The 25565 port is the default minecraft server port
just so you all know
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Server carried out an attack on another server on the Internet Alfred H Linux - Security 2 07-10-2014 12:47 AM
Logs Explaining: Worrying Server Log After Possible Attack (sites probed the server) amanacare Linux - Security 7 06-25-2012 04:06 PM
Server Attack jitenagr Linux - Server 5 11-10-2006 06:50 AM


All times are GMT -5. The time now is 03:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration