1,105,636 Community Members

security in linux

Member Avatar
paulas24
Light Poster
37 posts since Nov 2009
Reputation Points: 0 [?]
Q&As Helped to Solve: 1 [?]
Skill Endorsements: 0 [?]
 
0
 

hello everyone

Of late, our company has been getting attacks from someone on the internet and this has led us to being black listed. The administrator thinks its through my machine that the attacker is gaining access. I use ubuntu 10.04.3 on a windows network. How can I tell if someone is broken on to my system. something else my machine is trying to override the domain controller. is it possible?

Member Avatar
jbennet
Moderator
17,127 posts since Apr 2005
Reputation Points: 1,618 [?]
Q&As Helped to Solve: 736 [?]
Skill Endorsements: 38 [?]
Team Colleague
Featured
 
0
 

Check your open ports and install a firewall (i.e. "ufw"). Make sure SSH is disabled.

Member Avatar
kletig
Newbie Poster
15 posts since Mar 2012
Reputation Points: 0 [?]
Q&As Helped to Solve: 2 [?]
Skill Endorsements: 0 [?]
 
1
 

Hi!

What kind of attacks are we talking about here? Blacklisted from what?

If your client somehow is infected and it effects the entire network something is seriously wrong.

Member Avatar
FelineHazard
Light Poster
46 posts since Feb 2012
Reputation Points: 0 [?]
Q&As Helped to Solve: 3 [?]
Skill Endorsements: 0 [?]
 
0
 

To enhance your system against bruteforce attacks you may want to use fail2ban, which blocks multiple SSH attempts. You may look at [http://www.daniweb.com/hardware-and-software/linux-and-unix/threads/417280/configuring-iptables-to-block-multiple-ssh-attempts](this recently solved post).
You can also read the [http://www.la-samhna.de/library/brutessh.html](excellent post by Rainer Wichmann) that discusses bruteforce attacks.
Good luck!
-FH

Member Avatar
FelineHazard
Light Poster
46 posts since Feb 2012
Reputation Points: 0 [?]
Q&As Helped to Solve: 3 [?]
Skill Endorsements: 0 [?]
 
0
 
Member Avatar
FelineHazard
Light Poster
46 posts since Feb 2012
Reputation Points: 0 [?]
Q&As Helped to Solve: 3 [?]
Skill Endorsements: 0 [?]
 
0
 

On a second thought, you can also look through /var/log/auth.log to see if someone's been naughty. There are several logs in the /var/log directory that are useful to see if someone is trying to access your machine. Try to look for ssh attempts in hours/times when you weren't the one initiating them.
This is, of course, if the attack you are refering to is ssh attack.
-FH

Question Answered as of 8 Months Ago by FelineHazard, jbennet and kletig
You
This question has already been solved: Start a new discussion instead
Post:
Start New Discussion
View similar articles that have also been tagged: