1

I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.

Note: In the log report, I replace the name of my website with example.com and my second domain with example2.com and my server pc with examplepc. 157.230.xx.xx is my IP with last two numbers masked with xx. Also masked my Mac address 96:33:83:xx:xx:xx:xx:00:00:00:01:01:08 too.

I checked the syslog.

cat /var/log/syslog

The syslog starts as follows

Jan  1 00:00:01 examplepc systemd[1]: man-db.service: Succeeded.
Jan  1 00:00:01 examplepc systemd[1]: Finished Daily man-db regeneration.
Jan  1 00:00:01 examplepc CRON[3974370]: (root) CMD (test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew)
Jan  1 00:00:02 examplepc systemd[1]: logrotate.service: Succeeded.
Jan  1 00:00:02 examplepc systemd[1]: Finished Rotate log files.
Jan  1 00:00:18 examplepc kernel: [42022950.043766] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=142.129.131.197 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=46 ID=55498 PROTO=TCP SPT=50775 DPT=23 WINDOW=63855 RES=0x00 SYN URGP=0 
Jan  1 00:00:22 examplepc kernel: [42022954.042656] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=183.21.225.162 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=14658 PROTO=TCP SPT=11149 DPT=37215 WINDOW=52341 RES=0x00 SYN URGP=0 
Jan  1 00:00:40 examplepc kernel: [42022971.931450] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=192.241.206.10 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=54321 PROTO=TCP SPT=44994 DPT=27017 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:01:00 examplepc kernel: [42022992.752601] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=79.124.62.78 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=3745 PROTO=TCP SPT=57381 DPT=34749 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:01:25 examplepc kernel: [42023017.777908] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=120.48.118.41 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=44 ID=59705 PROTO=TCP SPT=9154 DPT=23 WINDOW=2018 RES=0x00 SYN URGP=0 
Jan  1 00:01:46 examplepc kernel: [42023038.283867] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=193.111.199.83 DST=10.15.0.5 LEN=437 TOS=0x00 PREC=0x00 TTL=53 ID=33865 DF PROTO=UDP SPT=5118 DPT=5060 LEN=417 
Jan  1 00:02:01 examplepc kernel: [42023053.305873] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=193.47.61.149 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=58242 DPT=81 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:02:22 examplepc kernel: [42023074.787200] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=167.94.138.152 DST=157.230.xx.xx LEN=44 TOS=0x00 PREC=0x00 TTL=36 ID=36427 PROTO=TCP SPT=31275 DPT=9743 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:02:39 examplepc kernel: [42023091.437028] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=152.32.141.108 DST=10.15.0.5 LEN=60 TOS=0x00 PREC=0x60 TTL=50 ID=7574 DF PROTO=TCP SPT=42851 DPT=1190 WINDOW=29200 RES=0x00 SYN URGP=0 
Jan  1 00:03:00 examplepc kernel: [42023112.673115] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=79.124.62.78 DST=157.230.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=975 PROTO=TCP SPT=57381 DPT=29198 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:03:22 examplepc kernel: [42023134.856018] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=124.235.116.137 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=50 ID=31683 PROTO=TCP SPT=55172 DPT=23 WINDOW=50580 RES=0x00 SYN URGP=0 
Jan  1 00:04:00 examplepc kernel: [42023172.777134] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=79.124.62.82 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=51820 PROTO=TCP SPT=57378 DPT=23042 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:04:02 examplepc kernel: [42023174.416129] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=94.102.61.2 DST=157.230.xx.xx LEN=44 TOS=0x00 PREC=0x00 TTL=245 ID=54321 PROTO=TCP SPT=39674 DPT=8630 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:04:21 examplepc kernel: [42023193.003365] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=167.248.133.163 DST=10.15.0.5 LEN=44 TOS=0x00 PREC=0x00 TTL=36 ID=43859 PROTO=TCP SPT=5201 DPT=12447 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:05:18 examplepc kernel: [42023250.562612] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=192.241.232.12 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=54321 PROTO=TCP SPT=33907 DPT=27018 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:05:20 examplepc kernel: [42023252.660425] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=43.131.91.178 DST=10.15.0.5 LEN=52 TOS=0x08 PREC=0x00 TTL=49 ID=20501 DF PROTO=TCP SPT=21525 DPT=12262 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:05:21 examplepc kernel: [42023253.266858] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=89.248.165.104 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=28501 PROTO=TCP SPT=52400 DPT=9990 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:06:10 examplepc kernel: [42023302.743477] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=89.248.165.70 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=33850 PROTO=TCP SPT=56825 DPT=5560 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  1 00:06:12 examplepc kernel: [42023304.498482] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=146.88.240.4 DST=10.15.0.5 LEN=30 TOS=0x00 PREC=0x00 TTL=242 ID=54321 PROTO=UDP SPT=47271 DPT=3283 LEN=10 
Jan  1 00:06:22 examplepc kernel: [42023314.289398] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=165.22.106.132 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=251 ID=54321 PROTO=TCP SPT=51633 DPT=3128 WINDOW=65535 RES=0x00 SYN URGP=0 
Jan  1 00:06:43 examplepc kernel: [42023335.684694] [UFW BLOCK] IN=eth0 OUT= MAC=96:33:83:xx:xx:xx:xx:00:00:00:01:01:08:00 SRC=185.246.220.165 DST=10.15.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=34055 DPT=81 WINDOW=65535 RES=0x00 SYN URGP=0

This [UFW BLOCK] keep continuing none-stop.

To me this looks like a DDoS attack. Despite receiving a request about every 15 seconds is not too much. These [UFW BLOCK] keep continueing so far. Not sure if I should block all such incomming IPs.

In between of the blocking logs, I can see some logs such as

Jan  1 00:09:01 examplepc systemd[1]: Starting Clean php session files...
Jan  1 00:09:01 examplepc sessionclean[3974459]: PHP Warning:  PHP Startup: Unable to load dynamic library 'mysqli' (tried: /usr/lib/php/20190902/mysqli (/usr/lib/php/20190902/mysqli: cannot open shared object file: No such file or directory), /usr/lib/php/20190902/mysqli.so (/usr/lib/php/20190902/mysqli.so: undefined symbol: mysqlnd_global_stats)) in Unknown on line 0
Jan  1 00:09:01 examplepc systemd[1]: phpsessionclean.service: Succeeded.
Jan  1 00:09:01 examplepc systemd[1]: Finished Clean php session files.
Jan  1 00:09:01 examplepc CRON[3974481]: (root) CMD (  [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi)

repeating regularly every half an hour

and

Jan  1 00:11:45 examplepc postfix/smtpd[3974488]: connect from unknown[193.56.29.178]
Jan  1 00:11:46 examplepc postfix/smtpd[3974488]: disconnect from unknown[193.56.29.178] ehlo=1 quit=1 commands=2

repeating irreqularly with average distance of roughly 14 minutes.

this message has other variations such as

Jan  1 01:54:07 examplepc postfix/smtpd[3975141]: connect from unknown[45.81.39.57]
Jan  1 01:54:07 examplepc postfix/smtpd[3975141]: lost connection after CONNECT from unknown[45.81.39.57]
Jan  1 01:54:07 examplepc postfix/smtpd[3975141]: disconnect from unknown[45.81.39.57] commands=0/0

or

Jan  1 04:52:34 examplepc postfix/smtpd[3976389]: warning: hostname zg-1220i-85.stretchoid.com does not resolve to address 162.243.133.21
Jan  1 04:52:34 examplepc postfix/smtpd[3976389]: connect from unknown[162.243.133.21]
Jan  1 04:52:34 examplepc postfix/smtpd[3976389]: lost connection after UNKNOWN from unknown[162.243.133.21]
Jan  1 04:52:34 examplepc postfix/smtpd[3976389]: disconnect from unknown[162.243.133.21] unknown=0/1 commands=0/1
Jan  1 04:52:35 examplepc postfix/smtpd[3976389]: warning: hostname zg-1220e-29.stretchoid.com does not resolve to address 192.241.223.21
Jan  1 04:52:35 examplepc postfix/smtpd[3976389]: connect from unknown[192.241.223.21]
Jan  1 04:52:35 examplepc postfix/smtpd[3976389]: lost connection after UNKNOWN from unknown[192.241.223.21]
Jan  1 04:52:35 examplepc postfix/smtpd[3976389]: disconnect from unknown[192.241.223.21] unknown=0/1 commands=0/1

or

Jan  1 05:35:04 examplepc postfix/smtpd[3976896]: connect from unknown[193.239.164.121]
Jan  1 05:35:05 examplepc postfix/smtpd[3976896]: NOQUEUE: reject: RCPT from unknown[193.239.164.121]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<WIN-CLJ1B0GQ6JP>
Jan  1 05:35:05 examplepc postfix/smtpd[3976896]: disconnect from unknown[193.239.164.121] ehlo=1 mail=1 rcpt=0/1 rset=1 quit=1 commands=4/5

I also see

Jan  1 04:55:55 examplepc postfix/anvil[3976391]: statistics: max connection rate 1/60s for (smtp:162.243.133.21) at Jan  1 04:52:34
Jan  1 04:55:55 examplepc postfix/anvil[3976391]: statistics: max connection count 1 for (smtp:162.243.133.21) at Jan  1 04:52:34
Jan  1 04:55:55 examplepc postfix/anvil[3976391]: statistics: max cache size 2 at Jan  1 04:52:35

with average timing of every 14 minutes. Usually, hapennig a few minutes after the connect from unknown errors.

Am I under DDoS attack? How far have they gone? Should I be worried any penetration to my system?

Improve this question
5
  • welcome- i'm not convinced your adversary/ies are performed a denial-of-service attack, distributed or otherwise - at least one of the ip addies you refer to is in the AbuseIPDB, maybe you can consider filtering connections based on this? in the meantime, if you can, you could change db/ other credentials on the remote hosts that were stored on the webserver (ie. bringing those applications down for the time being 'til you can satisfy yourself that no access has been obtained, and the host can be updated)
    – brynk
    Commented Jan 1, 2023 at 23:06
  • 4
    "Am I under DDoS attack?" - What you see is the normal noise which happens if you put a system on the internet. Nothing here indicates a DDoS attack. "Should I be worried any penetration to my system?" - you should worry about this before you put a system on the internet, i.e. sufficiently harden the system, You cannot prevent other probing your system if you offer services to the public, but you can harden it enough so that it will only be probing an not compromising your system.
    – Steffen Ullrich
    Commented Jan 2, 2023 at 5:47
  • Are you running postfix on purpose?
    – le3th4x0rbot
    Commented Jan 2, 2023 at 23:12
  • @trognanders, my website uses postfix for user registration. But no user is registered. The website is so new.
    – martiz
    Commented Jan 4, 2023 at 2:12
  • @martiz Postfix has a high abuse potential if misconfigured. If the website is only sending outgoing mail you should probably not expose its port to the internet.
    – le3th4x0rbot
    Commented Jan 4, 2023 at 4:06

1 Answer 1

Reset to default
2

Welcome to the internet!

This is normal. It's called "internet background noise" and happens to every online server, all the time.

You have a service with a public reachable address, random bots and scanners will hit it all the time. That's why you must keep any public reachable service updated with all security patches applied, all the time.

There are services that scan the internet and record all running services, all open ports and maybe software versions, so as soon as an exploit for a particular software is found, there will be attacks on those services minutes after the exploit is disclosed.

For that reason, keep your software updated, don't run any service that you don't need (like postfix), and I would suggest you to install something like fail2ban and portsentry. They will make portscanning your server almost impossible, and keep repeated attacks banned on your firewall.

Improve this answer
5
  • 1
    Reminds me of the time a place I worked for left up an old version of their site running a WordPress release about two years behind. No changes, no interaction with it, yet when they returned to it they found it full of spam posts advertising things in Polish.
    – Luke Sawczak
    Commented Feb 26, 2023 at 13:19
  • I do not need to receive any email by my website. Can I make my address completely private?
    – martiz
    Commented Mar 3, 2023 at 7:16
  • If you don't need to receive email, you don't need to enable postfix.
    – ThoriumBR
    Commented Mar 3, 2023 at 9:49
  • @ThoriumBR, but I still need postfix to send email for email verification. Isn't it?
    – martiz
    Commented Mar 6, 2023 at 1:35
  • No, postfix is to receive email. To send email you can use the libraries of the programming language you are using and a remote SMTP server.
    – ThoriumBR
    Commented Mar 6, 2023 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .