My new server got hacked (sigh).
I have physical access to my machine. It seems like the only changes made was a new user account created and a broken /etc/sudoers
file.
It seems as though the password was discovered by dictionary attack.
After I fix these problems (or do a full re-install?), I want to add a mechanism to ban an IP (for maybe 24 hours or some time limit) after getting the password wrong x number of times, but I'm not a unix sysadmin or anything, so I'm not really sure where to get started.
What software should I use and how can I configure it?
Thanks.