Fedora 24 server help - Blat Attack

Operating Systems & Open Source Linux
,
1

Hey guys,

So I was running a Debian 8.x server for my media collection (emby). I could remote SSH in and access my media library via Emby from any web connection after logging in.

Recently, my Debian install took a nose dive after an update. So I decided to switch to Fedora 24 server. I also found out from my ISP that the reason my network keeps dropping on me is that someone has been attempting to Brute-Force my SSH server as well as being hit by a Blat Attack (DoS attack) several times a day.

As my server is setup now with SELinux (Permissive - for Sonarr and Nzbget), I can no longer remotely login to SSH nor to my Cockpit or Emby servers.

I want to know what you guys recommend I setup my SSH with for security and remote access. I have of course changed the SSH port and disabled Root login. I have considered trying to do the 3 or 4 factor SSH authentication method but am unsure if I should just carry a thumb drive around with the keys on it or not.

I also have Fail2ban installed and configured.

Would someone like to walk me through setting up remote access and security for my server?

The following Services and ports need remote access:

  • Emby Server - Port 8096
  • Cockpit Manager - Port 9090
  • Sonarr Daemon - Port 8989
  • Nzbget Daemon - Port 6789
  • SSH - Port TBD
  • No-IP client for DDNS

The server is headless.

Another potential service and port I am considering setting up is HTPC Manager - port 8085

I appreciate the assistance. I really hope I can kill off this Blat Attack and Brute Force attack annoyance.

2

Firewalld is enabled by default did you open those services on the right zone?

The brute force isn't an issue it's a matter of like with a public IP address I'm contsistsntly hit with brute forcebatracks

3

what about the DoS Blat Attack?

I added the Emby and Sonarr services to the Public zone. I assumed that was the WAN facing Zone. I am unable to SSH into my server from my own local network either. I do have physical k/b access to the server since it is right next to my desktop and has its own monitor, mouse and keyboard though. I want to be able to remotely admin it from work though.

Maybe setup a VPN for it?

4

SSH with key is the best way to have a secure connection. If you're getting DoS a lot you should stop using No-IP for a while and maybe setup a script that sends an email every time your IP changes. Also did you set Fail2Ban for a permanent IP ban if there are too many invalid acceses?