How to secure LINUX BOX from Hacking

[Ivan Ferreira]

>> What u suggested is correct,somebody trying to hack my m/c.I found the ssh log failures in /var/log/secure for every few minutes and 4 to 5 failed login attempts... are found.
let me know what i can do in this problems..

Once I changed the default SSH port to anotherone, so basic attacks can be stopped.

You should also configure the following options in the sshd_config file:

PermitRootLogin no

And you can restrict who can login with SSH by configuring:
AllowUsers or AllowGroups

You can have a even more secure environment if you use only public keys and disable password authentication:

PasswordAuthentication no

[palaniappan.sp]

Hi ivan,

Actually I had changed the port of ssh and implemented iptables,cancel the permission for root login.
but i didn't do the public key authentication..Thanx for remaining this...
could u pls explain the usage of audit2allow command with example..
I am parallely collecting details regarding this....

Regds,
palani.

[Ivan Ferreira]

Please See this page:

http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/selg-section-0120.html

[Colin Topliss]

If you want to look at blocking access from IP addresses that have attempted to access your servers without authorization, you could also look at portsentry and swatch.

Portsentry can be found at
http://sourceforge.net/projects/sentrytools/

Swatch can be found at
http://sourceforge.net/projects/swatch

I use swatch (which unfortunately requires you to create a config file for it for it to be of any use) to update my firewall to block IP address that attempt to SSH to my system with a username not in my username list. The trouble is of course is that the firewall blocked list can become quite large... :-)

Colin.

[Rick Garland]

There is a book from O'Reilly called "Linux Security Cookbook". It has descriptions of the above posts with examples.