I experience multiple attacks on my server recently (for past several days).
Types of these attacks are e.g.:
- Several SQL Injection methods (select/union/where/null, etc.)
- Brute force attacks (e.g. for root access via SSH, multiple authentication failures to different services)
- Scanning for commonly known vulnerable files etc.
- Scanning for not removed install.php install/ files/folders, etc.
- SSH insecure connection attempts (scans)
- Multiple web server 400 error codes (/w00tw00t.at.ISC.SANS.DFind:), etc.)
- Attempts to access forbidden file or directory
- Attempts to login using a non-existent user to different services.
- And so on...
The attacks are from China, France, US, etc.
Example IPs:
- 122.225.109.205
- 46.105.250.105
- 108.23.96.102
- ....
I've contacted (or at least tried) some of the possible owners of the servers, which attack was carried out from (If I could find any information about it).
What steps I undertook:
- Changed every password to all services/ssh/databases, etc. to 250-char random strings (including special chars of course).
- Revoke root access via SSH
- Set up firewall
- Set up hosts.deny
- Removed nearly all private/public key pairs from server (only crucial keys with only read access to repositories)
- Configured proper chmod/chown for web applications/sites
- Configured proper php.ini (with e.g. most strict settings for disable_functions, etc.)
- Upgraded all packages (databases/java/php, etc.)
- I've also installed security program (considering security here I won't say which one was that) which intercepts most of above attacks and e.g. autommatically adds IP addresses to hosts.deny & firewall, etc.
Is there anything else I can do?
My question is what can I do to defend & possibly prevent further attacks? It looks like somebody is eager to hack into my server...