Greetings! <div class="gmail_quote"> I wanted to share my little script with you, server owners. A week or two ago I have set up an Ubuntu server box, with some services (Apache, MySQL) for personal usage. But my webserver is getting attacked by flood bots from time to time, so I needed to develop a wall (using Shorewall firewall) for it, and an easy manage script. The two script files (ip.sh and log.sh) are the swiss army knife for me right now. (You need to put them into your webserver log folder (/var/log/apache2)) What I am asking for, knowing that people here are developers with more knowledge than me - log.sh: lists the access.log (or anything else log file specified in the first argument) and filters out the "banned" IP-list - ip.sh: (needs to run as root) manages the IP filtering (also adjusts Shorewall's blacklist) There are some awkward, flood-like entries in my webserver's log. They seems to be some sort of vulnearability checks, should I be worried? Can you please give me some more tips on how to improve my server's security? Some more information which might help us identify problems: - Server is basically a desktop computer with Ubuntu server OS on it. - 320 GB HDD, in the following setup: - /dev/sda - boot record in MBR - /dev/sda1 (/boot, ext4, ~2 GiB) - /boot stuff - /dev/sda2 (/, ext4, ~233 GiB) - everything else - /dev/sda5 (swap, swap, ~6 GiB) - swap space - TP-LINK 1043ND router with Firewall - Shorewall firewall on the server itself (I have attached the configurational files for Shorewall too) - Installed services: - * Apache, MySQL - * SSH - * Samba $ uname -a Linux the-server 2.6.38-13-server #54-Ubuntu SMP Tue Jan 3 13:55:59 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux Sorry if my e-mail was a little bit hard to understand. Any help is appreciated. -- Whisperity. </div>