LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-01-2013, 02:56 AM   #1
icoman
LQ Newbie
 
Registered: Apr 2009
Posts: 5

Rep: Reputation: 0
Port Scanning and ssh2 brute force attempts


I also get:

Mar 1 07:50:58 ns sshd[4492]: Failed password for invalid user Admin from

::ffff:218.xx.xx.xx port 63778 ssh2
Mar 1 07:50:58 ns sshd[4493]: Failed password for invalid user user1 from

::ffff:218.xx.xx.xx port 64844 ssh2
Mar 1 07:50:58 ns sshd[4500]: Invalid user na from ::ffff:218.xx.xxx.xx

and from many other IP

I checket netstat -p and seems clean !

can u help me with advices ?
 
Old 03-01-2013, 04:08 AM   #2
pk21
Member
 
Registered: Jun 2002
Location: Netherlands - Amsterdam
Distribution: RedHat 9
Posts: 549

Rep: Reputation: 30
The log entry's you are seeing are just log in attempts. There are lots of scripts scanning for open ssh ports and trying some username/password combinations to get access to systems.
I guess it is easiest to only allow ssh access from ip addressess you connect from and block traffic to port 22 from every other ip in your iptables firewall.
You can also change your sshd_config to set a maximum number of login attempts with the option "MaxAuthTries 3", probably there is already a default of 6.
 
Old 03-01-2013, 04:43 AM   #3
icoman
LQ Newbie
 
Registered: Apr 2009
Posts: 5

Original Poster
Rep: Reputation: 0
Smile

Quote:
Originally Posted by pk21 View Post
You can also change your sshd_config to set a maximum number of login attempts with the option "MaxAuthTries 3", probably there is already a default of 6.
So i verified MaxAuthTries in sshd-config and it was commented with #, so that's why i got so many tries to break user/pass in var/log/secure.

My server was configured in 2004 last time by some friend, with fedora core 3, and is up and now.
I am a beginner in linux sistems, i would be interested to allow connection on SSH only to 1 or 2 ip local or from WAN.

Would u be kind to help me with these set up ?

Also i want to block/add some of those ip who attack my server to actual firewall (iptable) to ignore them from now on.

Thank you.

Last edited by icoman; 03-01-2013 at 04:51 AM. Reason: mis speled
 
Old 03-01-2013, 05:50 AM   #4
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Rocky 9.2
Posts: 18,362

Rep: Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751
@pk21: it says RH 9 on your profile
@icoman: are you really running Fedora 3

In both cases, those OSes have not been updated in years and are wide open to exploits.
You really need to get current: Fedora is at v18 or 19 I believe.
The old RH series ended on v9. I recommend going for Centos 6.3 ( a free version of RHEL)

https://en.wikipedia.org/wiki/Fedora...ting_system%29
https://en.wikipedia.org/wiki/Red_Hat_Linux
https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux
https://en.wikipedia.org/wiki/CentOS
 
Old 03-01-2013, 02:49 PM   #5
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,627

Rep: Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651
icoman
Quote:
Hi same problem
and running the long dead fedora 3 or 4 ,You will have problems .
install fedora 18 first
then see

but for a server
fedora is really the very LAST thing that should be installed on it

Using a long life distro like the current CentOS 6.3 would be best , if you stay in the red hat family
 
Old 03-04-2013, 01:28 AM   #6
icoman
LQ Newbie
 
Registered: Apr 2009
Posts: 5

Original Poster
Rep: Reputation: 0
I already installed CENTOS on separate HDD .. for testing purpose BUT CAN'T configure to match old server config, i mean to keep online 3 website and 7 email clients.
Mostly i don't or cant configure the apache to see those 3 site.
The user email i created but that's all that works ..
CentOS come with apache installed but cant config that .. and i reinstalled and then was up and runnig but for 1 site only...

If there is other linux distro better for server please recommend one and link for tutorial install - configuration.

Last edited by icoman; 03-04-2013 at 01:29 AM. Reason: mispelled
 
Old 03-04-2013, 02:33 AM   #7
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,627

Rep: Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651
Quote:
Mostly i don't or cant configure the apache to see those 3 site.
without being able to read your "httpd.conf" file and any ".htacces " files
i can only guess

the 3 are using a virtual host
if the httpd.conf file is still the DEFAULT ( but edited) file
90% of it is instructions on setting it up
BUT here is the BIG problem
fedora3 had i think Apache2.2
Centos6 has Apache2.4
there is a very big difference in the two
see the apache documentation
http://httpd.apache.org/
2.2
http://httpd.apache.org/docs/2.2/
and 2.4
http://httpd.apache.org/docs/2.4/

the apache 2.4 virtual host section
http://httpd.apache.org/docs/2.4/vhosts/

for running a server the three best are
--- place in ANY order ! all 3 are about the same ---
RHEL- current
Debian stable
Slackware
 
Old 03-04-2013, 04:28 AM   #8
icoman
LQ Newbie
 
Registered: Apr 2009
Posts: 5

Original Poster
Rep: Reputation: 0
thank you. i will install new linux debian i think ... or centos these friday.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
fail2ban best method of blocking brute force attempts? mrtwice Linux - Security 3 12-09-2008 10:52 AM
Recent trend in brute force attempts unixfool Linux - Security 1 10-03-2008 10:36 AM
ssh brute force attempts coolb Linux - Security 4 06-04-2006 04:53 AM
Port Scanning and ssh2 brute force attempts Fedora Core 4 hazmatt20 Linux - Security 12 02-05-2006 09:09 PM
Blocking brute force port scanning?? FunkFlex Linux - Security 1 05-03-2002 01:43 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:45 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration