Last night, I was shutting down my server and I saw a message asking if I wanted to shut down a "pts/0" session. Odd, I thought. So I logged back in and did a
finger and saw that there was someone logged in from a remote IP address (an Italian address) and they were issueing lots of
scanssh commands. They had also changed the password for the account they had logged in as (it was my child's account and the password was easy to guess - he's only 6!).
OK, so I left some ports open - my fault entirely. I was fortunate that the account is limited. There was also a file called
W2ksp3.exe (or something similar) in the account's home folder. So I guess someone was using my server to look for compromised windows' PCs.
So, my network looks like this:
internet - eth0 - server - eth1 - LAN
and it was the server that was compromised. The server is using
dnsmasq for DNS lookups and a DHCP server for the LAN.
This leads me to two questions:
How do I configure the firewall (
iptables?) to block everything on
eth0apart from http, outgoing ftp, e-mail and anything else needed to access the internet?
How do I stop logins via
eth0but allow them via