You aren't safe just because you run Linux

I picked up a link to this article that was posted on Slashdot. It appears that the compromised systems were hacked by either exploiting an exposed user's ssh access (probably a brute force attack that found a weak password) or by finding an unpatched remote admin tool (e.g., roundcube was mentioned in one of the links that came up when I Googled the attack name).

The sad thing is that there are a number of ways to keep brute force attackers at bay for ssh. Fail2ban is probably the most comprehensive and can be used to protect other exposed logins such as web mail. Another alternative is to use the built-in Linux firewall (iptables) to only allow so many connection attempts from a specific IP address before blocking future connections from the offending IP address. I posted an extensive article on my personal blog on how to set up this particular method (and a few other ssh "protection" tricks) if anyone is interested.

Cheers,
Dave