80+ "IPTables Denied" Access Attempts in less than 12 hours
Yesterday when I was monitoring my logs I noticed something alarming (to me) happening, and I'm not sure how concerned I should actually be, and what action may need to be taken.
Over the past 12 hours I've logged over 80 unique IP's (may have over counted or missed a few), often with one of the "unique" IP's making several attempts (2, sometimes up to 5 attempts) in a row. Now, Iptables appears to be doing its job, as they are all "denied", however I'm wondering why are there so many attempts (most of the IP's seem to be from china)? What could they be trying to do, other than access the server?
Should I be concerned with this seemingly high number, and is there anything else I should do to ensure my Linode is completely secured?
3 Replies
@jongirard:
Should I be concerned with this seemingly high number
Bwahahahahaha - oh sorry, you're serious.
When it gets up to 80 A SECOND, then you might want to be worried, until then ignore it.
Welcome to the internet - for the most part, it's a dark and nasty place - get used to it.
This doesn't mean you should ignore the fact that you've seen an increase in unknown access attempts. This could be a precursor to a larger attack (as other Linode users have experienced within the last week). Paying attention is never a bad thing. Your "Iptables appears to be doing its job" comment should give you some comfort.
How to secure your Linode depends on the type of software you're running on it. There are plenty of security holes out there targeting specific types of installations. Make sure your software is up-to-date and pay attention to your site traffic, error logs and your good friend IPtables.
