0

I have a raspberry pi that is running a website on apache2. The only other thing running on it is a script running to read out some sensors and store the information in a database (running every minute through cron).

Usually it's running well for a few weeks, and then it seems to "hang" all of a sudden. The webpage is not reachable anymore (although sometimes I do get a response after trying 10 times), connecting to it with putty is not possible anymore, even when I connect a screen and keyboard to it, I do not get any response anymore. the only thing that works is a cold reboot, after Wich everything works fine again.

it looks like the raspberry pi is incredibly busy with something, I would like to figure out what's causing the problem, but I don't really have a clue where to get started. The standard log files are not giving me much clues it seems, is there any kind of monitoring tool I could enable to debug the problem?

1

What do you get when you ping the IP or run curl -I xxx.xxx.xxx.xxx (Your IP address or web url)? Are you using an internal IP or public IP? One problem that I see for self-hosted server with SSH port open is that it attracted a lot of brute force attempts if there is no IP-blocking or rate-restriction setup, it could bring down the server or caused the server running at high cpu utilisation (especially for Apache). But those activities normally will show up on access log or auth log.

0

It's been a while, but I'm still facing the same problems.

If I execute that curl command, I get responses like these: enter image description here

The server is open for ssh connections from the outside. I would like to open a ssh session with putty wherever I am, so I did not do anything with IP-blocking or rate-restriction.

I think you've put me on the right path, because when I look at /var/log/auth.log, I see tons of these

Mar 23 08:47:46 raspberrypi sshd[10877]: Failed password for root from 183.214.141.105 port 11178 ssh2
Mar 23 08:47:48 raspberrypi sshd[10885]: Failed password for root from 218.65.30.124 port 8771 ssh2
Mar 23 08:47:50 raspberrypi sshd[10885]: Failed password for root from 218.65.30.124 port 8771 ssh2
Mar 23 08:47:53 raspberrypi sshd[10885]: Failed password for root from 218.65.30.124 port 8771 ssh2
Mar 23 08:47:55 raspberrypi sshd[10885]: Failed password for root from 218.65.30.124 port 8771 ssh2
Mar 23 08:47:59 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:01 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:04 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:07 raspberrypi sshd[10906]: Failed password for root from 218.65.30.124 port 42671 ssh2
Mar 23 08:48:07 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:09 raspberrypi sshd[10906]: Failed password for root from 218.65.30.124 port 42671 ssh2
Mar 23 08:48:09 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:11 raspberrypi sshd[10906]: Failed password for root from 218.65.30.124 port 42671 ssh2
Mar 23 08:48:12 raspberrypi sshd[10899]: Failed password for root from 183.214.141.105 port 4092 ssh2
Mar 23 08:48:14 raspberrypi sshd[10906]: Failed password for root from 218.65.30.124 port 42671 ssh2
Mar 23 08:48:17 raspberrypi sshd[10906]: Failed password for root from 218.65.30.124 port 42671 ssh2

I will have a look into how I can better secure the open ssh port against these brute force attacks.

  • 1
    If you really need to access SSH via public IP, I would strongly suggest to setup fail2ban, I have an article written on how to do so, my article is based on Nginx, but should not be difficult to implement it on Apache. – hcheung Jul 4 '17 at 5:51
  • 1
    Looking at your log data, it seem that root is a valid user for login. You should also disable the root login by editing /etc/ssh/sshd_config, and change the PermitRootLogin to no, and add DenyUsers root if it not exist yet. Please see my article on how to [Secure the Raspberry Pi](Secure the Raspberry Pi) on more detail description. – hcheung Jul 4 '17 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.