How To Secure (Ubuntu Server ) Linked Through DDNS

Question

i have ubuntu server i use to access it through DDNS & Ubuntu Server is running as guest os

Services running on Ubuntu Server

1. apache
2. ssh
3. dns
4. samba

---

i m also looking for tools which email me if some try to do something ( if possible )

Answer 1

You can do 3 things.

1) Each server can be hardened. For example, ssh - use keys , disable password authentication. Your question was not exactly on how to harden each server, so I will not go into further detail , but check on this.

Included in this would be mod evasive , apparmor, and possibly mod_security.

2) Personally I use iptables. You can not completely prevent a DDOS mind you.

http://blog.bodhizazen.net/linux/prevent-dos-with-iptables/

The trick with iptables is to tune it to your server, my rules may not work for you, you may need to be more liberal or strict, but it should get you started.

For ssh I use these iptables rules for rate limiting.

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

3) For monitoring network traffic I highly advise snort, especially on a busy server. Snort will alert you to traffic you need to analyze.

Short of snort you can look at psad and fwsnort. I have a tutorial on those on my site as well.