Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just setup an ubuntu web server to use at home as a backup and development server for a website i have. I am using dyndns so my colleges can access this also and test new code.

This works well but im worried about security. This has only been open to the world for 24 hours and already had hack attempts from 4 different ip addresses. (korea and hong kong)

  • hack attempts being trying to login over ssh with usernames such as root, oracle, smbuser

How can i secure this server more so i can feel at ease?

FYI, the data is not highly confidential so not the end of the world if anyone gets in, but obviously don't want people playing around with it.


Update, i did add my public ssh key to the server to login but after a restart went back to normal

share|improve this question

migrated from Oct 29 '11 at 20:54

This question came from our site for pro webmasters.

Disable password based authentication and change SSH port to something else, would probably keep you relatively safe against brute-force attacks. (that's done through sshd config file).

Additionally if you know IPs of folks who need to access your home server you can tweak iptables to only allow connections from those IPs.

share|improve this answer
Switching to SSH via keys only is by far the most important thing to do. Here are detailed instructions. – bgvaughan Oct 29 '11 at 21:49

Also disable root access via ssh, and enable MaxTries.

Visit for more information on it.

share|improve this answer
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Peachy Nov 7 '12 at 4:00

In addtion to disabling password-based authentication, try this:

sudo apt-get install denyhosts

It does wonders. Moreover, if you are using keys to log in, your own failed attempts to guess the passphrase won't count, so this way you won't run the risk of locking yourself out of your machine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.