7

My new server got hacked (sigh).

I have physical access to my machine. It seems like the only changes made was a new user account created and a broken /etc/sudoers file.

It seems as though the password was discovered by dictionary attack.

After I fix these problems (or do a full re-install?), I want to add a mechanism to ban an IP (for maybe 24 hours or some time limit) after getting the password wrong x number of times, but I'm not a unix sysadmin or anything, so I'm not really sure where to get started.

What software should I use and how can I configure it?

Thanks.

1
  • assuming that logins were attempted using SSH I strongly suggest to look into public key auth, and if possible enforce its use (and disallow password login). from my experience this is easily as effective in preventing basic hacking attempts as fail2ban and the like. both approaches can also be combined if need be.
    – mnagel
    Oct 24, 2018 at 16:44

3 Answers 3

9

I recommend looking at fail2ban to do this for you:

https://help.ubuntu.com/community/Fail2ban

(Also, yes, I would just do a fresh install, especially if they got root access.)

2
  • By default root user is disabled in ubuntu. fail2ban and ssh key based authentication is more secure than password. Oct 25, 2018 at 6:51
  • If they managed to break the sudoers file, they managed to get root access. Fresh reinstall is now mandatory. Oct 25, 2018 at 7:40
7

fail2ban is a good solution, but I'm a fan of DenyHosts, which is available in the repos. Just do sudo apt-get install denyhosts, and that will install DenyHosts and start it with a pretty sensible configuration.

3

CSF will be a better option for you.

ref: http://humanlinux.blogspot.com/2009/05/how-to-install-csf-in-ubuntu-linux.html

2
  • +1. CSF is awesome. Have used Fail2Ban without problems before, but CSF is really a big step forward. Jan 12, 2011 at 14:47
  • CSF sounds cool but I am sad that it does not have any repo packages so I can just apt-get it
    – sova
    Jan 12, 2011 at 22:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .