Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have just setup an Ubuntu web server to use at home as a backup and development server for a website I have. I am using dyndns so my colleges can access this also and test new code.

This works well but I'm worried about security. This has only been open to the world for 24 hours and already had hack attempts from 4 different IP addresses. (korea and hong kong)

  • hack attempts being trying to login over ssh with usernames such as root, oracle, smbuser

How can I secure this server more so I can feel at ease?

FYI, the data is not highly confidential so not the end of the world if anyone gets in, but obviously don't want people playing around with it.

Update, I did add my public ssh key to the server to login but after a restart went back to normal

share|improve this question

migrated from serverfault.com Oct 29 '11 at 12:49

This question came from our site for professional system and network administrators.

add comment

2 Answers

There's 2 approaches you can take

Security by obscurity - change the port, and don't use obvious usernames and passwords

Active defence - I use fail2ban to automatically block bruteforce attempts - its triggered off by a certain number of failed logins (which is configurable), and sets off a firewall rule to block such attempts. I go for a draconian 3 failures, and a one week ban, which tends to put a damper on any brute force attemps

share|improve this answer
add comment

Unfortunately, SSH brute-forcing attempts are a fact of the Internet. If you have an open SSH port, automatic scanning will find it, and start grinding against it.

SSH HoneyPot password stats (source)

Short of installing DenyHosts, there isn't much you can do about it other than make sure that any passwords you have are long and complex, and force public-key auth where possible. Your SSH logs will still be full of invalid login attempts, but they won't be able to get anywhere.

share|improve this answer
    
1. Is there a way to block ssh to certain IP ranges 2. when I enabled public-key auth before and logged in from another computer it was still possible with the right username and password. is it possible to only allow public key auth only? –  user103378 Oct 29 '11 at 12:58
    
@lee: I set my sshd to pubkey-only and no root login. But I'm about to install sshguard to keep them from trying, not only ssh but www too. sshguard.net –  ott-- Oct 29 '11 at 15:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.