high number of outbound UDP packets originating from your server: disabled

Easiest way to secure your open-to-public ssh server: change the port and install 2-way authentication.
Problem solved. But the initial questions were not answered yet, what UDP ports are you getting packed on?
Code: 
# ss -naturl | grep udp
 
Mike Edge said:
Not always... In my case for example, OVH were just complete idiots claiming forum mailers as SPAM.
Click to expand...
Do you throttle postfix, so you don't send gazillions of emails per second? For sure OVH panicked, they are fighting spammers off their servers.
 
Floren said:
Easiest way to secure your open-to-public ssh server: change the port and install 2-way authentication.
Problem solved. But the initial questions were not answered yet, what UDP ports are you getting packed on?
Code: 
# ss -naturl | grep udp
Click to expand...

jgas said:
One week after re-enabling my server, I obviously had another attack.
The port was number 80.
Click to expand...

Think he indicated port 80.:)
 
Floren said:
Easiest way to secure your open-to-public ssh server: change the port and install 2-way authentication.
Code: 
# ss -naturl | grep udp
Click to expand...
Does this not present a hassle if you are using SCP to send multiple files at different time (but in a short period) from your desktop to the server. Would you not have to get a notification for input of the key each time?
 
Floren said:
Do you throttle postfix, so you don't send gazillions of emails per second? For sure OVH panicked, they are fighting spammers off their servers.
Click to expand...

Yeap postfix can not be thottled, it was fine for 6 months too. Oh well worked out for the best anyway, the new data center we now use Go Racks is much better, even our customers notice the difference in both speed and cleaner packets and I received all my money back from my June invoice that I just paid before we were cut from paypal as they refused to refund it even though the billing cycle for it didn't start for another week.

I read on their forum they had suspended 41k servers that day for different reasons.
 
Mike Edge said:
Oh well worked out for the best anyway, the new data center we now use Go Racks is much better, even our customers notice the difference in both speed and cleaner packets
Click to expand...
Is that that sucky Server Complete? ;)
I just wish I coulda let them suck another $70'ish from me for another one of those Nehalem's. :cry:
So far I've been very impressed with their response time to all tickets I've submitted (asking about upgrades, etc - not any problems with the server).
 
Mike Edge said:
Yeap postfix can not be throttled.
Click to expand...
Of course it can, is the most important feature allowing you to manage the server load.
http://www.postfix.org/postconf.5.html
Start with default_destination_rate_delay, there are many other options to fine tune your delivery frequency.
Tracy Perry said:
Does this not present a hassle if you are using SCP to send multiple files at different time (but in a short period) from your desktop to the server. Would you not have to get a notification for input of the key each time?
Click to expand...
No, works great with ssh keys also. :)
http://www.axivo.com/go/googleauth
 
Tracy Perry said:
Think he indicated port 80.:)
Click to expand...
Thanks, UDP 80? OP reply: The technique is very simple, the hacker sends a bunch of packets forcing the victim server to reply, generating implicitly a huge usage of bandwidth. There are hundreds of scripts like that on the Internet, taking advantage of unsecured servers. Changing the host won't do much, the attacker only needs to change the ip address. The only solution is to secure your server with the usual tools, Cloudflare, Nginx, Selinux, iptables, etc.
 
Last edited:
Floren said:
Of course it can, is the most important feature allowing you to manage the server load.
http://www.postfix.org/postconf.5.html
Start with default_destination_rate_delay, there are many other options to fine tune your delivery frequency.

No, works great with ssh keys also. :)
http://www.axivo.com/go/googleauth
Click to expand...

Fine if you run CentOS, but I don't think (not sure since I haven't researched it yet) that it will with Debian (run both that is) unless you compile the source. I'm into pain, but not THAT much pain. ;)
The Google authenticator is available in a .deb package, but you have to choose apples or oranges (keys or not).
 
Last edited:
You must log in or register to reply here.
Top Bottom