Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Last night, I was shutting down my server and I saw a message asking if I wanted to shut down a "pts/0" session. Odd, I thought. So I logged back in and did a finger and saw that there was someone logged in from a remote IP address (an Italian address) and they were issueing lots of scanssh commands. They had also changed the password for the account they had logged in as (it was my child's account and the password was easy to guess - he's only 6!).

OK, so I left some ports open - my fault entirely. I was fortunate that the account is limited. There was also a file called W2ksp3.exe (or something similar) in the account's home folder. So I guess someone was using my server to look for compromised windows' PCs.

So, my network looks like this:

internet - eth0 - server - eth1 - LAN

and it was the server that was compromised. The server is using dnsmasq for DNS lookups and a DHCP server for the LAN.

This leads me to two questions:

  1. How do I configure the firewall (iptables?) to block everything on eth0 apart from http, outgoing ftp, e-mail and anything else needed to access the internet?

  2. How do I stop logins via eth0 but allow them via eth1

share|improve this question
    
As an aside, check your logs for to see if the user got root. My opinion is that they probably did, especially if scanssh wasn't on your server before. –  Broam Dec 20 '10 at 17:46
    
@Broam: I checked them. It appears there were two logins, the first just found the login details and the attacking computer (whois says it's an Italian address) must have 'phoned home' since a short while later another computer with a different IP address (Korean I think) logged in and then changed the password and then started scanssh'ing. –  Skizz Dec 20 '10 at 23:08

5 Answers 5

up vote 3 down vote accepted

To disable SSH on certain interfaces, just follow these steps:

First, find the IP address of the server on the eth1 using ifconfig or some other method. This could for example be 192.168.0.12.

Open your /etc/ssh/sshd_config file (sudo nano /etc/ssh/sshd_config) and add edit the following line:

#ListenAddress 0.0.0.0

(which means "listen to all interfaces") to this:

ListenAddress 192.168.0.12

(which means "only listen to connections from the interface this IP belongs to").

Then restart the SSH server:

sudo /etc/init.d/ssh restart

Now it should only accept connections from that interface.

share|improve this answer
    
That was straightforward. –  Skizz Dec 20 '10 at 16:37
    
Straightforward, except that you get an error about failing to bind to the IP address. To fix this, you need to start/restart the ssh service in the if-up.d folder (/etc/network/if-up.d). –  Skizz Dec 20 '10 at 23:04
    
You did replace 192.168.0.12 with your own local IP address, right? –  Frxstrem Dec 22 '10 at 17:48

I second the recommendations of putting a router between your server and the Internet. It's an easy way of having a first line of defense.

In case you ever want to enable ssh from outside, it's a good idea to disable password authentication and keep only public key authentication. That way, you're immune to password guessing attacks: ssh can only be used into an account on which you have deliberately created an authorized_keys file, and only if the attacker has obtained your private key somehow. (You're still vulnerable to remote vulnerabilities in OpenSSH, but these are extremely rare and usually patched quickly.)

Make sure you have the following settings in /etc/ssh/sshd_config:

PubkeyAuthentication yes
ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no
share|improve this answer

[I'd comment if I could.]

Good answers so far, but I would also add that throwing a router in between your server and the rest of the internet probably isn't a bad idea unless you really have a compelling reason not to. If nothing else it's like the door on your house/apartment/domicile/place-of-habitation -- it discourages people from wandering in and looking around, even if there is nothing for them to see.

share|improve this answer

For your first question you will need to setup a firewall. If your server is fully exposed to the internet, this is highly recommended. You might want to look at the Ubuntu Wiki. If you have a router it might do this for you.

For the second part you might want to configure sshd to listen only to local addresses. That's of course assuming your eth1 has a static ip. In your /etc/ssh/sshd_config modify the ListenAddress line. It should look soething like ListenAddress 10.10.0.1:22 where you replace your static eth1 ip.

And why does your 6 year old child need shell access to your server?

share|improve this answer
    
You're right, he doesn't, again, lack of experience setting stuff up on Ubuntu on my part. –  Skizz Dec 20 '10 at 10:51

Just close the port exposed to the public. Usually it is controllable by the router you are using. In ssh's case, it is port 22.

share|improve this answer
    
There's no router between the internet and the server. –  Skizz Dec 20 '10 at 10:52
    
Then close ssh port on the server exposed to public by executing sudo /etc/init.d/ssh stop. –  Gödel Dec 20 '10 at 10:53
    
Wouldn't that close it on both adapters? I have two, one on a LAN and one on the internet. Logging in via the LAN is OK (you'd need physical access to LAN, and if you've got that, then you've got bigger problems, i.e. there's someone in your house!). How do I stop login via a particular interface? –  Skizz Dec 20 '10 at 11:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.