Failed login attempts on server

[rtpb5642]

I run RHEL 7 Linux on my server and i get around 30 failed login attempts to my root accound every 3 minutes.

 

www.server.bartsch-communications.com is my website (i only have it for fun but i do host a minecraft server on the domain)

 

I have port forwarded 21,22,80,25565,10000

 

Anything i should be worried about?

 

BTW last weekend i logged in on saturday as root and by monday there were 70000 failed attempts.

[Decon]

I run RHEL 7 Linux on my server and i get around 30 failed login attempts to my root accound every 3 minutes.

 

www.server.bartsch-communications.com is my website (i only have it for fun but i do host a minecraft server on the domain)

 

I have port forwarded 21,22,80,25565,10000

 

Anything i should be worried about?

 

BTW last weekend i logged in on saturday as root and by monday there were 70000 failed attempts.

sounds like some sort of primitive DOS attack...

[Altecice]

you might want to set up some IDS? I used to run a simple Fail2Ban script that would look at the logs and ban IP's (from iptables) for 12 hours. 

[manikyath]

port 21 and 22 are very common ports for low-intelligence attacks (script trying to log in with default passwords on every public IP address)

[rtpb5642]

Okay thanks

 

But yeah on average 8 attempts per min

[SIGSEGV]

sounds like some sort of primitive DOS attack...

Nah, more like some sort of not particularly powerful brute force attack

[Decon]

Nah, more like some sort of not particularly powerful brute force attack

hmm that too...

 

unless OP is a total dumbass, brute force attacks are a total waste of resources and time. N00b haxorz be hax'n

[rtpb5642]

Nah, more like some sort of not particularly powerful brute force attack

Thats what i was thinking, any reason i'm a target? I get like 5 views a day on my site and 5 people usually on the MC server so not much traffic...

[rtpb5642]

hmm that too...

 

unless OP is a total dumbass, brute force attacks are a total waste of resources and time. N00b haxorz be hax'n

My password is 32 digits so im secure, just kinda odd to see all the attempts when i log in.

 

I dont believe im a dumbass as i have pretty decent networking knowledge, but then again im 15

[SIGSEGV]

Thats what i was thinking, any reason i'm a target? I get like 5 views a day on my site and 5 people usually on the MC server so not much traffic...

That's exactly why, since you're smaller he'd expect your security to be less advanced, take a look at this:

And since the computer we're talking about in this case is a server it could provide some serious fire power for DDoS attacks

[rtpb5642]

That's exactly why, since you're smaller he'd expect your security to be less advanced, take a look at this:

And since the computer we're talking about in this case is a server it could provide some serious fire power for DDoS attacks

Thanks, makes sence

The server is an i5 4670k so its a decent cpu, anyway i have a good password so i guess im okay

[SIGSEGV]

Thanks, makes sence

The server is an i5 4670k so its a decent cpu, anyway i have a good password so i guess im okay

Is it a Unix based server?

[rtpb5642]

Is it a Unix based server?

Red Hat Enterprise Linux 7

[SIGSEGV]

Red Hat Enterprise Linux 7

When did you last update? Are you on at least Red Hat Enterprise Linux 7 - bash-4.2.45-5.el7_0.2?

[rtpb5642]

When did you last update? Are you on at least Red Hat Enterprise Linux 7 - bash-4.2.45-5.el7_0.2?

Yes lastest version, i do yum update once a day

[Noxxx]

install "fail2ban"

[ItsFTP]

LMAO

21,22

I'M DYING, CALL ME AN AMBULANCE! 

Sorry but WHY would you have SSH open on 22?

 

Go into /etc/ssh/sshd_config and change the port as soon as possible because you're probably gonna go down really soon.