LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-02-2012, 03:50 PM   #1
todo
LQ Newbie
 
Registered: Jan 2012
Location: sweden
Posts: 5

Rep: Reputation: Disabled
Exclamation i think someone hacking my server


Hello i think someone hacking my linux debian server. i have a minecraft server on it. yesterday the my internet died 3 times and it was only the internet. the LAN works. i needed to reboot the rauter to get back my internet. and when i turn off the server computer the internet works fine. hacker??

can i get some tips how to protect my server and internet

i have linux debian 6.0.3
minecraft server port is 25565 and 25566

sorry for my spelling :P

Last edited by todo; 05-02-2012 at 03:57 PM.
 
Old 05-02-2012, 04:50 PM   #2
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
Your question is very generic in nature and you may not get the best response. You can take a look at the following guide for Linux security info: http://tldp.org/LDP/solrhe/Securing-...ution-v2.0.pdf
 
Old 05-02-2012, 04:57 PM   #3
TommyC7
Member
 
Registered: Mar 2012
Distribution: Slackware, CentOS, OpenBSD, FreeBSD
Posts: 530

Rep: Reputation: Disabled
Could've just been your ISP having a hiccup. A simple internet disconnection isn't necessarily the sign of a hacker and the best place to check is your /var/log anyways.
 
Old 05-02-2012, 04:59 PM   #4
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
He brings up a good point, have you talked wiht your ISP about your upstream limit? Running a server, esp a hosted app like MineCraft or a Game server will consume quite a bit of upstream data and they may be killing your connection to prevent you from using it if you are not paying for it.
 
Old 05-02-2012, 06:26 PM   #5
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
Checking with your ISP a good initial step. You should also focus on gathering data and evidence to determine if there is a problem and if so, to define the nature of the problem so that proper measures may be taken. Given the nature of your system, a game server, it is entirely possible, if not reasonable to expect, that you are being subject to malicious traffic. Consequently, a traffic analysis would be in order. To perform this analysis try using a combination of netstat to see the number of concurrent connections, ntop to see if you have a bandwidth hog, and tcpdump with a bpf filter and see if you can get a pcap dump for traffic analysis. See this thread (page 3) for some insights: http://www.linuxquestions.org/questi...100/page3.html
 
Old 05-03-2012, 11:44 AM   #6
todo
LQ Newbie
 
Registered: Jan 2012
Location: sweden
Posts: 5

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by TommyC7 View Post
Could've just been your ISP having a hiccup. A simple internet disconnection isn't necessarily the sign of a hacker and the best place to check is your /var/log anyways.
ok but a player told he come to hack the server
 
Old 05-03-2012, 12:08 PM   #7
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
Quote:
Originally Posted by todo View Post
ok but a player told he come to hack the server
You are going to need DATA to solve this problem. You need to obtain either router logs, or some other form of traffic analysis to determine the problem. Until you have obtained data, the rest is just useless speculation.
 
1 members found this post helpful.
Old 05-04-2012, 11:24 AM   #8
todo
LQ Newbie
 
Registered: Jan 2012
Location: sweden
Posts: 5

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Noway2 View Post
You are going to need DATA to solve this problem. You need to obtain either router logs, or some other form of traffic analysis to determine the problem. Until you have obtained data, the rest is just useless speculation.
ok but i can log data on the router but i can see the logs xD
 
Old 05-06-2012, 03:04 AM   #9
hua
Member
 
Registered: Oct 2006
Location: Slovak Republic
Distribution: Slackware 14.2, current
Posts: 461

Rep: Reputation: 78
Just an idea. I had a same issue and finally I found out that my router after cca. 3-4 years had such a serious holes that the ISP released a firmware upgrade. I upgraded the firmware and now it works fine.
Did you check whether the manufacturer of your router doesn't release a new firmware upgrade?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Nintendo server attacked by hacking group Lulz Security Jeebizz Linux - News 0 06-06-2011 08:32 AM
Hacking Exposed Wireless Hacking Chapter prompt Linux - Wireless Networking 0 05-08-2004 02:44 PM
server hacking gonz Linux - Security 2 11-23-2001 04:13 AM
server hacking gonz Linux - Software 1 11-21-2001 11:02 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration