Ddos-attack
De Wiki Técnico Rioja. Administra tus sistemas.
Detección del ataque
SSH
journalctl --since "24 hour ago" | grep -i "Failed password for invalid user" | awk '{print $13}' | sort -n | uniq
journalctl --since "24 hour ago" | grep -i "Failed password for root " | awk '{print $11}' | sort -n | uniq
MYSQL
En plesk:
watch -n 0.5 'mysql -uadmin -p`cat /etc/psa/.psa.shadow` -e "show processlist;"'
WEB
Postfix
Intentos fallidos de login
journalctl --since "4 hour ago" | grep "SASL LOGIN authentication failed:" | awk '{print $7}'| cut -d [ -f2 | cut -d ] -f1 | sort -n | uniq -c | sort -n | awk '{print $2}'
