3 ms·
Yes. Many years ago a server was gotten into by a brute force ssh script. The cracker then used a local exploit to gain root access and run all sorts of unple
by modoc 17y ago
Yes. Many years ago a server was gotten into by a brute force ssh script. The cracker then used a local exploit to gain root access and run all sorts of unpleasant software, downloaded my databases, etc...
I ended up just getting a new server, as I couldn't track down all the things he'd done. I started learning about server security. I reduced the number of people who had ssh accounts, and installed stronger password rules. I use iptables to block brute force SSH attempts. I use logcheck, chkrootkit, and other tools to constantly monitor my server.
- pert 17y agoI'd say the the single most important thing that you've mentioned there is 'logcheck'. If you can remove all of the login spam (by moving ssh to a non-default port for example), then watching your logs becomes a reasonable task and will alert you to any specifically targeted attacks.