Server Security

amarverma

Today I open terminal on aapanel dashboard, and get noticed below message:
Last failed login: Thu Nov 26 19:12:27 UTC 2020 from 119.29.16.190 on ssh:notty
There were 3137 failed login attempts since the last successful login.
Last login: Thu Nov 26 11:57:22 2020 from 127.0.0.1

Is there someone trying to hack my site/panel? If so, how to secure it?

Please guide ASAP.

Best reg.

pavlus

It`s normal. There are plenty of bots (especially from China) trying to probe servers around the word with some generic passwords.
Use fail2ban service to get rid of those attackers and ban it for some time.

idflorin

pavlus fail to ban works ok

Btw I setup this
https://prnt.sc/vqs4lb
How to setup dovecot? on which port?

pavlus

Go into terminal and check services and theier open ports by:

netstat -ltup

This will show you on which port attacker can listen and probe on.

idflorin

pavlus i see
https://prnt.sc/vqsp2q
imap pop3 imaps pop3s
which is more likely to attack?

pavlus

Most likely they will choose ports without any security certificates. But one important rule: if you have complex password - chance that they will hack your server is very low. But if you want to secure all stuff with fail2ban than use all of these:

POP3	110;995
IMAP	143;993
SMTP	25;587;465