I am currently setting up an Apache web server on a Linux machine at my house. I am working on a website project which will allow users to log in to complete certain work. There is no open registration on this website. Accounts must be issued by the administrator (which is currently me).
Since I have this server set up, I also want to make sure that I have it secure, to the best of my abilities. My knowledge is relatively limited in regards to cutting edge security.
I have some Linux packages installed to monitor and actively block suspicious connections.
I am looking through my logs, but I'm not entirely sure that I understand all that I am reading. I have
fail2ban. I have approximately three pages of log entries every hour similar to those examples below. From this information given, does it appear that I have my security set up properly? The entry which concerns me is the ones which contain
com.jcraft.jsch.JSchException, which is a known java exploit.
To be honest, I'm not even sure if I am asking the right questions. I am willing learn. I simply need guidance and the resources from which to learn. I can handle constructive criticism.
Here are a couple of examples of the types of entries I am seeing.
Apr 10 10:02:10 gcems sshd: Unable to negotiate with 126.96.36.199 port 52068: no +matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth] Apr 10 10:03:08 gcems sshd: Did not receive identification string from +188.8.131.52 port 46529 Apr 10 10:03:43 gcems sshd: Invalid user support from 184.108.40.206 port 54291 Apr 10 10:03:45 gcems sshd: error: Received disconnect from 220.127.116.11 port +54291:3: com.jcraft.jsch.JSchException: Auth fail [preauth] Apr 10 10:03:45 gcems sshd: Disconnected from 18.104.22.168 port 54291 [preauth]