Hello,

Yesterday when I was monitoring my logs I noticed something alarming (to me) happening, and I'm not sure how concerned I should actually be, and what action may need to be taken.

Over the past 12 hours I've logged over 80 unique IP's (may have over counted or missed a few), often with one of the "unique" IP's making several attempts (2, sometimes up to 5 attempts) in a row. Now, Iptables appears to be doing its job, as they are all "denied", however I'm wondering why are there so many attempts (most of the IP's seem to be from china)? What could they be trying to do, other than access the server?


Should I be concerned with this seemingly high number, and is there anything else I should do to ensure my Linode is completely secured?

Bwahahahahaha - oh sorry, you're serious.

When it gets up to 80 A SECOND, then you might want to be worried, until then ignore it.

Welcome to the internet - for the most part, it's a dark and nasty place - get used to it.

_________________
Either provide enough details for people to help, or sit back and listen to the crickets chirp.
Security thru obscurity is a myth - and really really annoying.

You're always going to have bots checking if you've "locked your doors". Though it can be a bit alarming when you first see this type of activity, it is normal for a web server. vonskippy is correct that the volume is insignificant.

This doesn't mean you should ignore the fact that you've seen an increase in unknown access attempts. This could be a precursor to a larger attack (as other Linode users have experienced within the last week). Paying attention is never a bad thing. Your "Iptables appears to be doing its job" comment should give you some comfort.

How to secure your Linode depends on the type of software you're running on it. There are plenty of security holes out there targeting specific types of installations. Make sure your software is up-to-date and pay attention to your site traffic, error logs and your good friend IPtables.

People are always going to be scanning. Unless it's causing a noticeable performance impact, it's not worth paying attention to.