Linux server down many times

[lsmail]

Hi,

Recently our Linux server was down many times since end of Dec. and this month so far. When it is down, all web server, FTP and email server all are down.

Someone has any idea how server can be down often ? What kind of factors we should check in order to avoid these type of downtime ?

Appreciate your help !

 

[Newposter]

You need to check your error logs. Linux is very rugged, so chances are that it's your internet connection that's breaking. Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[sleipnir214]

Without knowing anything about your system, I can only give general advice.

I recommend you take a close look at your system. Take a look at logs to see if you can figure out what's crashing the system: check whether someone has compromized your root password, whether w@rez d00dz have filled up your filesystem with pirated software, etc. Start at the end of the logs and work backward.

Linux, when installed from any standard distribution, is not that secure. There are daemons running by default which can open holes in your security. Unless you absolutely need it, don't run the daemon. Also, when you do the install (probably too late for this advice), customize the configuration and don't install stuff you don't need. I use RedHat -- it's installation system allows me the option (turned off by default) of selecting individually those packages I want to install.

I don't know how you're accessing your system remotely, but if you're using telnet, you're opening yourself up to potential heartache. Use SSH instead.

Make sure your system is running all the latest patches to the OS and supporting libraries.

Make sure your necessary daemons (httpd, ftpd, <your MTA>) are all running versions which are not known to be insecure. Make sure of the same for their support libraries.

Make sure that your necessary daemons are running in the most secure configuration possible. I know of many an adminstrator who forgot to turn off anonymous writing in his FTP daemon's configuration -- generally it comes to the admin's attention when some w@r3z d00d loads 6GB (yes, in one case 6GB) of pirated software on his system.

Don't let root login through SSH -- you can login as another user and &quot;su&quot; to root from there. &quot;root&quot; is the one username which is guaranteed to exist on a Linux system -- so it is the one which hackers will attempt to compromise.

Use a firewall and review your firewall rules regularly. I recommend firewall rule reviews monthly.

Want the best answers? Ask the best questions:

http://www.tuxedo.org/~esr/faqs/smart-questions.html

TANSTAAFL!