off hours shut down

Why? It won't save you any money unless you delete the Linode, as the resources are still reserved even when it's powered off. If you do demand-based scaling, turning up new servers in order to handle increased traffic, then sure, delete them when they're no longer needed. But if you just have one or two servers for whatever you're hosting, there's really no benefit.

Just thinking I might be a smaller target thats all. Money not the reason.

You're still a target. The attackers will just wait until your server is running. Turning it off is no substitute for proper security.

Leaving it on over night is the norm, but if you were looking to be less vulnerable to some attacks and maybe need a refresher on some security measures, this could help out:

https://www.linode.com/docs/security/se … our-server">https://www.linode.com/docs/security/securing-your-server

I turned off ftp and all of the attacking stopped immediately.

ftp??? wow hasn't that been deprecated for decades now, along with telnet???

I thought we've all moved to sftp + fail2ban…

pure ftpd

@IfThenElse:

ftp??? wow hasn't that been deprecated for decades now, along with telnet???

Not exactly the same. There's a huge number of people out there that still use FTP, including many "professional" web developers.

I beat my head against this for years, trying to educate the world, then gave up.

I provide FTP access on request (i.e., enable it for an account) and allow only designated IPs / net ranges (iptables). Failed connection attempts are logged so I can easily see what's going on.

aaah

"professional" web developers

:D