Help! Server Attack

[Rocket1]

On a non-managed Linux dedicated via GoDaddy. We have had an issue over the last two weeks with our server shutting down. Below is a response from the server peeps on the cause. Any suggestions would be greatly appreciated.

=============================

First off we are showing a large number of failed log in attempts and failed DNS lookups. These are results of attackers attempting to brute force your password, and domains resolving to your servers IP. You should be able to block most of this traffic through firewall rules.

The second issue, is that your mysql service is consuming 100% of the cpu, and you are maxing out your email relays. Normally these would be separate issues but they are directly related to each other. The reason why your email relays are getting maxed out is that your server is trying to send you email notices that your vbulletin database queries are failing. These same database queries are causing your mysql service load to spike.

My suggestion would be to review online for ways to harden a Linux server. This will provide you with suggestions on changes you can make to your server configuration that would make it so attacks against the server do not have as much of an effect on the operating level of the server.

==================

Anyone have any tricks to help out with this?

[MegaManSec]

I can help with this, I have alot of experience when it comes to security, DOS, and hacking in linux.
If you trust me, PM me your ssh details, and I'll set it all up.(then I'll tell you what I did)
If not,

Download ddosdeflate, turn off emailing on mysql error, iptables the attackers, etc etc..

Thanks, loaep

[doopz]

Originally Posted by loaep

I can help with this, I have alot of experience when it comes to security, DOS, and hacking in linux.
If you trust me, PM me your ssh details, and I'll set it all up.(then I'll tell you what I did)
If not,

Download ddosdeflate, turn off emailing on mysql error, iptables the attackers, etc etc..

Thanks, loaep

Hmm, how about he fixes the problem of why vbulletin is sending out MySQL errors ? That seems like a better suggestion to me.

Close down services such as FTP/SSH and only allow them for your own IP(s). You can also try and disable DNS lookups for them, but i suspect that closing down the hammered services will be enough.

I'm available for help if you need it.

[MegaManSec]

Originally Posted by doopz

Hmm, how about he fixes the problem of why vbulletin is sending out MySQL errors ? That seems like a better suggestion to me.

Close down services such as FTP/SSH and only allow them for your own IP(s). You can also try and disable DNS lookups for them, but i suspect that closing down the hammered services will be enough.

I'm available for help if you need it.

most likely because the error is 'mysql is gone' aka. there is no mysql server, because the ram is @ 100%..
you cant stop that.
You can however block the ip's, and set up a script to automaticly do it.