7

My new server got hacked (sigh).

I have physical access to my machine. It seems like the only changes made was a new user account created and a broken /etc/sudoers file.

It seems as though the password was discovered by dictionary attack.

After I fix these problems (or do a full re-install?), I want to add a mechanism to ban an IP (for maybe 24 hours or some time limit) after getting the password wrong x number of times, but I'm not a unix sysadmin or anything, so I'm not really sure where to get started.

What software should I use and how can I configure it?

Thanks.

  • assuming that logins were attempted using SSH I strongly suggest to look into public key auth, and if possible enforce its use (and disallow password login). from my experience this is easily as effective in preventing basic hacking attempts as fail2ban and the like. both approaches can also be combined if need be. – mnagel Oct 24 '18 at 16:44
7

fail2ban is a good solution, but I'm a fan of DenyHosts, which is available in the repos. Just do sudo apt-get install denyhosts, and that will install DenyHosts and start it with a pretty sensible configuration.

9

I recommend looking at fail2ban to do this for you:

https://help.ubuntu.com/community/Fail2ban

(Also, yes, I would just do a fresh install, especially if they got root access.)

  • By default root user is disabled in ubuntu. fail2ban and ssh key based authentication is more secure than password. – Khimananda Oli Oct 25 '18 at 6:51
  • If they managed to break the sudoers file, they managed to get root access. Fresh reinstall is now mandatory. – Shadur Oct 25 '18 at 7:40
3

CSF will be a better option for you.

ref: http://humanlinux.blogspot.com/2009/05/how-to-install-csf-in-ubuntu-linux.html

  • +1. CSF is awesome. Have used Fail2Ban without problems before, but CSF is really a big step forward. – Aron Rotteveel Jan 12 '11 at 14:47
  • CSF sounds cool but I am sad that it does not have any repo packages so I can just apt-get it – sova Jan 12 '11 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.