random PC tips

Here's my super simple iptables config file. It will accept SSH, HTTP and ping (ICMP) from anyone. Other inward connections will be dropped. Outward connections or connections from the local host are not restricted in any way. *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -j ACCEPT COMMIT In order to have the config automatically load during boot, I recommend the package iptables-persistent. On Ubuntu or Debian you should be able to install iptables-persistent with the command sudo apt-get install iptables-persistent Now you can save your configuration to the persistent iptable rule file /etc/iptables/rules.v4 and load it with the command sudo iptables-restore < /etc/iptables/rules.v4 Note that if you are using fail2ban, you should stop the fail2ban serv...

Today, when I was checking the logs on my server, I noticed that someone was trying to hack it by quessing usernames and passwords. The command cat /var/log/auth.log Returned something like this: Invalid user danica from (attacker ip) input_userauth_request: invalid user danica [preauth] pam_unix(sshd:auth): check pass; user unknown pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=(attacker ip) Failed password for invalid user danica from (attacker ip) port 20135 ssh2 Received disconnect from (attacker ip): 11: Bye Bye [preauth] reverse mapping checking getaddrinfo for (attacker host) [(attacker ip)] failed - POSSIBLE BREAK-IN ATTEMPT! Invalid user daniela from (attacker ip) input_userauth_request: invalid user daniela [preauth] pam_unix(sshd:auth): check pass; user unknown pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=(attacker ip) Failed password for invalid user daniela from (attacker ip) port 120...