Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My new server got hacked (sigh).

I have physical access to my machine. It seems like the only changes made was a new user account created and a broken /etc/sudoers file.

It seems as though the password was discovered by dictionary attack.

After I fix these problems (or do a full re-install?), I want to add a mechanism to ban an IP (for maybe 24 hours or some time limit) after getting the password wrong x number of times, but I'm not a unix sysadmin or anything, so I'm not really sure where to get started.

What software should I use and how can I configure it?

Thanks.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

fail2ban is a good solution, but I'm a fan of DenyHosts, which is available in the repos. Just do sudo apt-get install denyhosts, and that will install DenyHosts and start it with a pretty sensible configuration.

share|improve this answer

CSF will be a better option for you.

ref: http://humanlinux.blogspot.com/2009/05/how-to-install-csf-in-ubuntu-linux.html

share|improve this answer
    
+1. CSF is awesome. Have used Fail2Ban without problems before, but CSF is really a big step forward. –  Aron Rotteveel Jan 12 '11 at 14:47
    
CSF sounds cool but I am sad that it does not have any repo packages so I can just apt-get it –  sova Jan 12 '11 at 22:36

I recommend looking at fail2ban to do this for you:

https://help.ubuntu.com/community/Fail2ban

(Also, yes, I would just do a fresh install, especially if they got root access.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.