Tag: debian

Posted on

How to Secure SSH server from Brute-Force and DDOS with Fail2ban ( Ubuntu )

Fail2ban is a security tool used for preventing brute-force attack and Distributed Denial of Service (DDoS) attack to your GNU/Linux box.

Fail2ban monitors failed login attempts and subsequently blocks the ip address from further logins. Although Fail2ban can also be used to secure other services in Ubuntu server, in this post, I will only focus on securing SSH server.

Step 1: Install Fail2ban and (optionally) sendmail

sudo apt-get install fail2ban
sudo apt-get install sendmail-bin

Step 2: Setting up Fail2ban

Next, you need to configure fail2ban by creating a copy of ‘jail.conf’ to ‘jail.local’

cd /etc/fail2ban
sudo cp jail.conf jail.local

Step 3: General fail2ban configuration

Edit fail2ban configuration file using your favorite text-edito (I personally use ‘nano’)

sudo nano /etc/jail.local

You can set IP address for fail2ban to ignore, IP addresses can be separated by space.

Bantime is the duration of time that you want fail2ban to block suspicious attempt, the value is in seconds
Maxretry is the number of failed attempts before fail2ban block the IP-address, in this case 3600 means 1-hour ban

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1 192.168.1.1
bantime  = 3600
maxretry = 3

Step 4: Enabling ssh and ssh-ddos protection
Find ssh configuration under [ssh] heading, and enable it.

[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 3

Similarly, you can also enable [ssh-dos] protection by changing the enabled value to “enabled = true”

[ssh-ddos]
enabled = true
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 2

Step 5: Enable Sending Notification Email (optional)
Optionally you can have fail2ban sends you notification email in case of suspicious login detected. To do that, you need to locate destemail settings and changed it to your email

destemail = security@mypapit.net

Fail2ban can use ‘sendmail’ and ‘mail’ application to send notification email

Step 6: (Re-)start Fail2ban
After all is done, you may save the file, and (re)start the fail2ban service

sudo /etc/init.d/fail2ban restart

You can test the configuration by trying to login into your box. You may also check fail2ban log in /var/logs/auth.log (or in other directory specified in jail.local)

For more information about fail2ban, you can read : the official fail2ban manual

Recommended Reading

Posted on

Debian Squeeze 6.0.2 update (Security – important)

Debian project has released update on Debian 6.0 (Squeeze) which addressed several security issues and bugfix. Debian Squeeze users are advised to update their installation using “apt-get update” and “apt-get upgrade” command to ensure all of the updates are installed properly.

p/s: Although I currently use Ubuntu, I was actually a Debian user and I continue to use Debian on my VPS to host this website till this very day. Without Debian, I would never has discovered thousands of wonderful open source software in it vast software repositories :)

Posted on

Ubuntu 11.10 drops Synaptic package manager

The upcoming Ubuntu 11.10 release (Oneiric Ocelot) will drop Synaptic Package Manager from default installation in favor of Ubuntu Software Center.

This has been foreseen since Canonical has spend their effort in developing and improving Ubuntu Software Center as a convenience one-stop center to install free and paid software alike.

Personal Thoughts
Personally, I still prefer to use Synaptic Package Manager over Ubuntu Software Center as it is still doesn’t offer the same number of options that I used to get from Synaptic (ability to search by name, description, ability to test the fastest mirror).

But I believe the changes that Canonical and Ubuntu community made might make it easier to streamline the looks and functionality of package manager into desktop environment (Unity) regardless of the computing platform.

Synaptic

Posted on

How to solve Apache – Could not reliably determine the server’s fully qualified name – error in Ubuntu

Apache2 web server will almost always display this information message :
"Could not reliably determine the server's fully qualified name"
when it is first started in Ubuntu and Debian server.

The reason behind this message is because the web server fails to find the suitable domain name in the system.

How to remove the message
First, you need to edit “/etc/hosts” file and put your server name of choice in the file. For example:

127.0.0.1 server.mylocal

Then you need to add “ServerName” directive in the “/etc/apache2/apache2.conf” file.

ServerName server.mylocal

Finally, restart the web server for the changes to take effect. You will notice that the information message is gone now.

$ sudo service apache2 restart

Posted on

How to remove user name from MeMenu in Unity (Ubuntu Natty)

The newly released Ubuntu 11.04 (Natty Narwhal) features Unity shell interface which displays the current user name the top right of the panel (MeMenu) that adds a personalized feeling to desktop users.

However some users might not be comfortable to have their username appears on the computer screen, especially when they are working on a publicly accessible computer or when they do not want their username to appear on screenshots or screen-casts of their desktop.

So to remove the username, one only need to open a console, and run the following command:
gconftool -s /system/indicator/me/display –type int 0

Before

Before

After

Before

Alternatively, you can also choose to display your own fullname on MeMenu. You can do that by running the following command:
gconftool -s /system/indicator/me/display –type int 2

You return to the default setting of displaying your current username, by running:
gconftool -s /system/indicator/me/display –type int 1

.
.
.
[via Chicomonte]