hello everyone

Of late, our company has been getting attacks from someone on the internet and this has led us to being black listed. The administrator thinks its through my machine that the attacker is gaining access. I use ubuntu 10.04.3 on a windows network. How can I tell if someone is broken on to my system. something else my machine is trying to override the domain controller. is it possible?

Recommended Answers

Check your open ports and install a firewall (i.e. "ufw"). Make sure SSH is disabled.

Jump to Post

Hi!

What kind of attacks are we talking about here? Blacklisted from what?

If your client somehow is infected and it effects the entire network something is seriously wrong.

Jump to Post

All 5 Replies

Check your open ports and install a firewall (i.e. "ufw"). Make sure SSH is disabled.

Hi!

What kind of attacks are we talking about here? Blacklisted from what?

If your client somehow is infected and it effects the entire network something is seriously wrong.

On a second thought, you can also look through /var/log/auth.log to see if someone's been naughty. There are several logs in the /var/log directory that are useful to see if someone is trying to access your machine. Try to look for ssh attempts in hours/times when you weren't the one initiating them.
This is, of course, if the attack you are refering to is ssh attack.
-FH

Be a part of the DaniWeb community

We're a friendly, industry-focused community of 1.20 million developers, IT pros, digital marketers, and technology enthusiasts learning and sharing knowledge.