LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-28-2009, 11:21 AM   #1
duzap
LQ Newbie
 
Registered: Jun 2008
Posts: 25

Rep: Reputation: 15
Someone is attacking my server everyday and I really don't know what to do


Hello,
I have 100mbit dedicated server and everyday the server is attacked randomaly and I can't access to the server, a lot of timeouts, it looks like this when I am pinging it:

Code:
Pinging x.x.x.x with 32 bytes of data:

Request timed out.
Request timed out.
Reply from x.x.x.x: bytes=32 time=11ms TTL=58
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from x.x.x.x: bytes=32 time=10ms TTL=58
Reply from x.x.x.x: bytes=32 time=10ms TTL=58
Request timed out.
Request timed out.
Reply from x.x.x.x: bytes=32 time=12ms TTL=58
Request timed out.
etc ........
I don't know how to locate the IP addresses that are doing it.
I don't know how to check which type of attack it is.
I don't know how to secure it.
And I don't know what to tell to my customers, everyday they are having troubles with my server and I am losing money everyday because of this annoying attacker.

please help me, I am in a very bad situation in here, I started to think about leaving the hosting and sell my servers, I am losing money and customers everyday!

Every help will be appreciated and please try to be specfic because I am not unix professional.
Thanks in advance.
 
Old 07-28-2009, 11:55 AM   #2
TBC Cosmo
Member
 
Registered: Feb 2004
Location: NY
Distribution: Fedora 10, CentOS 5.4, Debian 5 Sparc64
Posts: 356

Rep: Reputation: 43
Instead of immediately suspecting an attack, better to start at network hardware (device interfaces) and work all the way up the stack to the OS. You may find that it is a network problem. Call your hosting provider.
 
Old 07-28-2009, 12:39 PM   #3
duzap
LQ Newbie
 
Registered: Jun 2008
Posts: 25

Original Poster
Rep: Reputation: 15
No, it's not a network problem and I can say it for sure.
 
Old 07-28-2009, 12:52 PM   #4
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 4,070

Rep: Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897
Quote:
Originally Posted by duzap View Post
Hello,

...etc ........
I don't know how to locate the IP addresses that are doing it.
I don't know how to check which type of attack it is.
I don't know how to secure it.
And I don't know what to tell to my customers, everyday they are having troubles with my server and I am losing money everyday because of this annoying attacker.

please help me, I am in a very bad situation in here...
I don't want to suggest attacks are in any way something that shouldn't be taken seriously, but you haven't given the rest of us any reason to believe there is anything going on here, apart from the there is a networking problem somewhere. So, what is your evidence, as you are so sure?
 
Old 07-28-2009, 02:01 PM   #5
orgcandman
Member
 
Registered: May 2002
Location: new hampshire
Distribution: Fedora, RHEL
Posts: 600

Rep: Reputation: 110Reputation: 110
what do you mean by the server is attacked randomly? do you mean that at a random point in time during the day the machine in question is unreachable? do you mean that once the networking issues start they persist for some random amount of time?

have you tried to traceroute and verify that it is your system? checked the inbound network traffic? checked with your isp?
 
Old 07-29-2009, 09:27 AM   #6
geek745
Member
 
Registered: Jul 2004
Location: Alton, IL
Distribution: Linux Mint; Slackware; Ubuntu; Slax
Posts: 172
Blog Entries: 2

Rep: Reputation: 34
Yes, you must check the logs... perhaps make logging more verbose for whatever servers you are running; if you aren't running a particular server software, then inbound connections to the ports that it uses should just disappear.

I had a bunch of dictionary/common name attacks to my ssh server, so i disabled password authentication over ssh, forcing everyone to use keys; you can also find some packages that will deny an IP access to your machine after a certain number of failed access attempts, at the firewall level - this is effective for denial of service attacks, which, if your server is really being attacked, is probably what's going on.
 
Old 07-29-2009, 11:00 AM   #7
nowonmai
Member
 
Registered: Jun 2003
Posts: 481

Rep: Reputation: 48
Quote:
Originally Posted by duzap View Post
No, it's not a network problem and I can say it for sure.
Why do you think it's an attack as opposed to a network problem?
 
Old 07-29-2009, 02:40 PM   #8
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 782
Blog Entries: 8

Rep: Reputation: 158Reputation: 158
Your issue is lacking details in the extreme. Providing some example of the issue you're facing is usually critical in receiving any type of help in these forums: firewall logs, system logs, apache logs...even netstat snapshots may help more than submitting no data at all.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Someone attacking my SSHd what should I do? newtommy Linux - Security 22 02-16-2008 03:51 PM
Hosts from your domain are attacking our server gomez Linux - Networking 6 01-03-2005 12:05 PM
Snort alert / Am i attacking ? exalik Linux - Security 6 10-22-2003 03:55 PM
attacking by http via port 80 LionKing Linux - Security 7 12-12-2002 12:08 PM
ISP attacking! drjimstuckinwin Linux - Security 9 08-10-2001 03:42 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration