Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

i have ubuntu server i use to access it through DDNS & Ubuntu Server is running as guest os

Services running on Ubuntu Server

  1. apache
  2. ssh
  3. dns
  4. samba

i m also looking for tools which email me if some try to do something ( if possible )

share|improve this question
    
+ configuration –  One Zero Feb 2 '12 at 19:58
add comment

1 Answer

up vote 2 down vote accepted

You can do 3 things.

1) Each server can be hardened. For example, ssh - use keys , disable password authentication. Your question was not exactly on how to harden each server, so I will not go into further detail , but check on this.

Included in this would be mod evasive , apparmor, and possibly mod_security.

2) Personally I use iptables. You can not completely prevent a DDOS mind you.

http://blog.bodhizazen.net/linux/prevent-dos-with-iptables/

The trick with iptables is to tune it to your server, my rules may not work for you, you may need to be more liberal or strict, but it should get you started.

For ssh I use these iptables rules for rate limiting.

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP

sudo iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

3) For monitoring network traffic I highly advise snort, especially on a busy server. Snort will alert you to traffic you need to analyze.

Short of snort you can look at psad and fwsnort. I have a tutorial on those on my site as well.

share|improve this answer
    
thanks alot , what would u more recommend for as for Security , i will look at your site as well –  One Zero Feb 2 '12 at 20:14
    
As I gain more experience, I isolate servers as much as possible (LXC / openvz), harden each server (http, ssh, etc), and a good dose of iptables. The I use either psad or snort +/- OSSEC. Sort of depends on the value of the target (server). –  bodhi.zazen Feb 2 '12 at 21:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.