Debian, serveur inaccessible

[stc]

Bonjour, j'ai un serveur debian wheezy sur un kimsufi qui me sert à heberger 2 sites web et depuis quelques temps celui-ci devient inaccessible au niveau de mes sites (http) mais aussi en ssh, un peu comme si j'avais tout bloqué avec iptables, puis le serveur redevient accessible.
Depuis j'ai mis pas mal d'outils style fail2ban pour sécuriser un peu tout ça mais les blocages reviennent régulièrement.
Depuis hier j'ai remarqué quelque-chose, si je me logue en ssh et que je lance la commande 'top', le serveur ne se bloque plus du tout.
Avez vous une piste d'idée pour mon problème ? j'ajoute que les logs ne donnent rien non plus.
Merci.

[DreAmuS]

Salut,

Je pense que tu a répondus toi-même. Une mauvaise configuration d'iptables serait le meilleur choix. J'ai testé et il est vrai que par http on est une fois sur 3 ou 4 non-accessible.

A mon avis tu devrais reprendre la configuration à zéro tranquillement et retester.

[stc]

Salut,

Je pense que tu a répondus toi-même. Une mauvaise configuration d'iptables serait le meilleur choix. J'ai testé et il est vrai que par http on est une fois sur 3 ou 4 non-accessible.

A mon avis tu devrais reprendre la configuration à zéro tranquillement et retester.

Merci pour ta réponse, concernant iptables, j'y avais pensé j'ai même tenté un :
# apt-get autoremove iptables
mais le blocage persistait.

[DreAmuS]

Bizarre ce que tu me dis la. Alors soit Fail2Ban à rajouter ton ip à iptables pour bloquer ton IP, soit tu n'es pas root au serveur.

Un souci d'authentification ? Un souci de permission ?

Essais ceci à tout hasard car parfois on tape à côté et c'est juste subtil:

sudo apt-get autoremove iptables

J'ai trouver cette solution sur un site d'entraide où la personne avais le même souci que toi :

sudo apt-get remove iptables
sudo apt-get update 
sudo apt-get install iptables

Je rajoute qu'un

sudo apt-get -u upgrade

Ne peut pas lui faire de mal non plus.

Essais déjà ces manipulations. Sinon tu devras virer manuellement les fichiers en allant les chercher dans leur emplacement un à un. Pour réinstaller l'ensemble correctement.

[stc]

Merci Dreamus pour tes conseils, j'ai essayé tes commandes mais le blocage persiste, quand à fail2ban, sans iptables je crois qu'il ne peut pas ajouter de règles.
Sinon mon serveur reçoit tout plein de requêtes de robots je pense (normal quoi) par contre sur les graphes d'ovh, dans le graphe 'paquets' j'ai souvent des pics (ce n'est pas la fréquentation de mes sites j'ai a peine 10 visites par jour), par exemple hier à 22h18 en upload : 69333 pps je ne sais pas à quoi ça correspond (paquets par seconde ?) mais c'est beaucoup non ? Ceci ne pourrait-il pas saturer mon serveur ? créer une pénurie de mémoire?
J'ai aussi logwatch ou l'on voit bien les logs d'iptables et http, par exemple hier :

--------------------- httpd Begin ------------------------ 

 
 Requests with error response codes
    400 Bad Request
       /w00tw00t.at.ISC.SANS.DFind:): 2 Time(s)
       /w00tw00t.at.ISC.SANS.Win32:): 2 Time(s)
    401 Unauthorized
       /manager/html;jsessionid=11C2D8D0D6F50F294 ... 8C595962AD64912: 1 Time(s)
    403 Forbidden
       /: 4 Time(s)
       /actionnews/index/: 2 Time(s)
       http://www.ly.com/: 2 Time(s)
       //: 1 Time(s)
       //404.cgi: 1 Time(s)
       //_mt/mt.cgi: 1 Time(s)
       //admin.cgi: 1 Time(s)
       //administrator.cgi: 1 Time(s)
       //agora.cgi: 1 Time(s)
       //analyse.cgi: 1 Time(s)
       //bandwidth/index.cgi: 1 Time(s)
       //bigconf.cgi: 1 Time(s)
       //cart.cgi: 1 Time(s)
       //cartcart.cgi: 1 Time(s)
       //cgi-bin/YaBB/YaBB.cgi: 1 Time(s)
       //cgi-bin/addbanner.cgi: 1 Time(s)
       //cgi-bin/adduser.cgi: 1 Time(s)
       //cgi-bin/admin.cgi: 1 Time(s)
       //cgi-bin/admin.pl: 1 Time(s)
       //cgi-bin/admin/admin.cgi: 1 Time(s)
       //cgi-bin/admin/setup.cgi: 1 Time(s)
       //cgi-bin/adminhot.cgi: 1 Time(s)
       //cgi-bin/adminwww.cgi: 1 Time(s)
       //cgi-bin/af.cgi: 1 Time(s)
       //cgi-bin/badmin.cgi: 1 Time(s)
       //cgi-bin/bigconf.cgi: 1 Time(s)
       //cgi-bin/book.cgi: 1 Time(s)
       //cgi-bin/build.cgi: 1 Time(s)
       //cgi-bin/classified.cgi: 1 Time(s)
       //cgi-bin/dig.cgi: 1 Time(s)
       //cgi-bin/download.cgi: 1 Time(s)
       //cgi-bin/ezboard.cgi: 1 Time(s)
       //cgi-bin/guestbook.cgi: 1 Time(s)
       //cgi-bin/handler.cgi: 1 Time(s)
       //cgi-bin/journal.cgi: 1 Time(s)
       //cgi-bin/login.cgi: 1 Time(s)
       //cgi-bin/mailnews.cgi: 1 Time(s)
       //cgi-bin/main.cgi: 1 Time(s)
       //cgi-bin/myguestbook.cgi: 1 Time(s)
       //cgi-bin/r.cgi: 1 Time(s)
       //cgi-bin/search.cgi: 1 Time(s)
       //cgi-bin/shop.cgi: 1 Time(s)
       //cgi-bin/store.cgi: 1 Time(s)
       //cgi-bin/test: 1 Time(s)
       //cgi-bin/test-cgi: 1 Time(s)
       //cgi-bin/test.cgi: 1 Time(s)
       //cgi-bin/test/test.cgi: 1 Time(s)
       //cgi-bin/test2.pl: 1 Time(s)
       //cgi-bin/traffic.cgi: 1 Time(s)
       //cgi-bin/ultraboard.cgi: 1 Time(s)
       //cgi-bin/upload.cgi: 1 Time(s)
       //cgi-bin/wwwboard.cgi.cgi: 1 Time(s)
       //cgi-mod/index.cgi: 1 Time(s)
       //cgi-sys/404.cgi: 1 Time(s)
       //cgi-sys/addalink.cgi: 1 Time(s)
       //cgi-sys/defaultwebpage.cgi: 1 Time(s)
       //cgi-sys/domainredirect.cgi: 1 Time(s)
       //cgi-sys/entropybanner.cgi: 1 Time(s)
       //cgi-sys/entropysearch.cgi: 1 Time(s)
       //cgi-sys/helpdesk.cgi: 1 Time(s)
       //cgi-sys/mchat.cgi: 1 Time(s)
       //cgi-sys/randhtml.cgi: 1 Time(s)
       //cgi-sys/signup.cgi: 1 Time(s)
       //cgi-sys/suspendedpage.cgi: 1 Time(s)
       //cgis/wwwboard/wwwboard.cgi: 1 Time(s)
       //connector.cgi: 1 Time(s)
       //debug.cgi: 1 Time(s)
       //index.cgi: 1 Time(s)
       //info.cgi: 1 Time(s)
       //login.cgi: 1 Time(s)
       //main.cgi: 1 Time(s)
       //submit.cgi: 1 Time(s)
       //suspendedpage.cgi: 1 Time(s)
       //test.cgi: 1 Time(s)
       //upload.cgi: 1 Time(s)
       //wwwadmin.cgi: 1 Time(s)
       //wwwboard.cgi: 1 Time(s)
       //wwwboard/wwwboard.cgi: 1 Time(s)
       //wwwboard/wwwsboard.cgi: 1 Time(s)
       /css/css: 1 Time(s)
       /favicon.ico: 1 Time(s)
       /login.action: 1 Time(s)
 
 ---------------------- httpd End ------------------------- 

 
 --------------------- iptables firewall Begin ------------------------ 

 
 Listed by source hosts:
 Logged 677 packets on interface eth0
   From 1.20.202.181 - 6 packets to tcp(23) 
   From 1.93.29.130 - 2 packets to tcp(22) 
   From 1.163.66.56 - 1 packet to tcp(3128) 
   From 2.32.122.36 - 2 packets to tcp(22) 
   From 2.50.10.92 - 2 packets to tcp(5900) 
   From 5.28.152.157 - 1 packet to tcp(23) 
   From 5.39.82.220 - 21 packets to tcp(25565,55661) 
   From 5.77.35.30 - 4 packets to tcp(4681,8860) 
   From 5.249.148.105 - 6 packets to tcp(8080) 
   From 5.255.87.26 - 5 packets to tcp(8088,21320) 
   From 14.39.80.148 - 1 packet to tcp(23) 
   From 14.139.207.126 - 1 packet to tcp(8080) 
   From 14.139.220.81 - 2 packets to tcp(8080) 
   From 14.198.134.155 - 3 packets to tcp(23) 
   From 23.16.7.12 - 7 packets to tcp(8080) 
   From 23.97.226.68 - 1 packet to tcp(22288) 
   From 23.98.161.19 - 2 packets to tcp(3389) 
   From 23.226.135.14 - 4 packets to tcp(8080) 
   From 27.101.109.184 - 1 packet to tcp(8080) 
   From 27.255.78.21 - 1 packet to tcp(3389) 
   From 31.148.219.9 - 3 packets to tcp(9064) 
   From 31.205.83.122 - 1 packet to tcp(8080) 
   From 36.81.2.189 - 1 packet to tcp(8080) 
   From 36.107.143.83 - 3 packets to tcp(23) 
   From 37.57.216.161 - 2 packets to tcp(25,3306) 
   From 37.203.214.105 - 1 packet to tcp(3128) 
   From 41.188.49.11 - 2 packets to tcp(8080) 
   From 46.21.99.26 - 2 packets to tcp(5900) 
   From 46.254.24.37 - 1 packet to tcp(8080) 
   From 49.64.154.38 - 2 packets to tcp(23) 
   From 50.2.43.45 - 3 packets to tcp(9064) 
   From 50.30.46.126 - 4 packets to tcp(8080) 
   From 58.48.109.53 - 2 packets to tcp(8080) 
   From 58.116.220.4 - 2 packets to tcp(8080) 
   From 58.253.247.181 - 1 packet to tcp(8080) 
   From 59.56.68.53 - 1 packet to tcp(35989) 
   From 59.173.1.102 - 1 packet to tcp(8822) 
   From 61.147.103.152 - 1 packet to tcp(1022) 
   From 61.147.107.66 - 1 packet to tcp(3306) 
   From 61.147.107.109 - 1 packet to tcp(9200) 
   From 61.155.106.35 - 4 packets to tcp(8080) 
   From 61.160.213.108 - 2 packets to tcp(9064,9393) 
   From 61.160.224.128 - 5 packets to tcp(22,25,110,123,135) 
   From 61.160.224.129 - 8 packets to tcp(873,1433,1521,1723,3128,3306,3389,8080) 
   From 61.160.224.130 - 7 packets to tcp(5800,5900,7001,8090,8888,11211,32764) 
   From 61.174.51.202 - 1 packet to tcp(22) 
   From 61.174.51.230 - 1 packet to tcp(22) 
   From 61.174.51.233 - 1 packet to tcp(22) 
   From 61.240.144.64 - 1 packet to tcp(123) 
   From 61.240.144.66 - 1 packet to tcp(21) 
   From 61.240.144.67 - 1 packet to tcp(7547) 
   From 62.90.179.224 - 1 packet to tcp(23) 
   From 62.210.84.75 - 1 packet to tcp(4868) 
   From 64.37.171.22 - 2 packets to tcp(48491) 
   From 64.211.24.227 - 1 packet to tcp(22) 
   From 65.111.166.20 - 4 packets to tcp(10000) 
   From 66.205.188.55 - 1 packet to tcp(8080) 
   From 66.240.192.138 - 1 packet to tcp(465) 
   From 66.240.236.119 - 2 packets to tcp(2222,6000) 
   From 67.23.166.110 - 4 packets to tcp(8080) 
   From 67.190.198.99 - 2 packets to tcp(8080) 
   From 68.168.220.2 - 4 packets to tcp(8080) 
   From 69.140.181.63 - 2 packets to tcp(8080) 
   From 70.33.229.146 - 1 packet to tcp(22) 
   From 71.6.135.131 - 2 packets to tcp(1200,7777) 
   From 71.6.165.200 - 1 packet to tcp(37) 
   From 71.6.167.142 - 1 packet to tcp(8834) 
   From 71.91.200.247 - 1 packet to tcp(1234) 
   From 71.172.83.43 - 1 packet to tcp(8080) 
   From 75.150.2.57 - 2 packets to tcp(23) 
   From 77.243.229.18 - 3 packets to tcp(23) 
   From 78.169.193.41 - 2 packets to tcp(23) 
   From 78.186.166.125 - 1 packet to tcp(23) 
   From 78.188.74.253 - 2 packets to tcp(23) 
   From 79.143.177.83 - 6 packets to tcp(8080) 
   From 80.191.12.44 - 3 packets to tcp(3389) 
   From 82.117.208.243 - 2 packets to tcp(23) 
   From 82.221.105.6 - 2 packets to tcp(5986,9100) 
   From 82.243.20.233 - 1 packet to tcp(8080) 
   From 83.168.246.113 - 3 packets to tcp(8080) 
   From 85.25.103.50 - 1 packet to tcp(8089) 
   From 85.105.22.124 - 2 packets to tcp(23) 
   From 85.185.236.10 - 4 packets to tcp(3389) 
   From 86.8.142.13 - 1 packet to tcp(8080) 
   From 88.5.57.148 - 6 packets to tcp(8080) 
   From 88.208.230.183 - 4 packets to tcp(1449,1640) 
   From 89.20.157.242 - 1 packet to tcp(8080) 
   From 91.90.172.4 - 4 packets to tcp(3389) 
   From 91.237.240.247 - 2 packets to tcp(8080) 
   From 91.238.134.92 - 2 packets to tcp(3128,8080) 
   From 92.86.83.67 - 3 packets to tcp(8080) 
   From 92.243.22.44 - 1 packet to tcp(8080) 
   From 93.174.93.51 - 4 packets to tcp(1038,6588,12110,19681) 
   From 93.187.124.202 - 1 packet to tcp(8080) 
   From 95.81.209.100 - 3 packets to tcp(23) 
   From 98.174.140.238 - 1 packet to tcp(8080) 
   From 103.29.249.250 - 2 packets to tcp(3389) 
   From 104.192.0.20 - 1 packet to tcp(5900) 
   From 106.83.83.177 - 1 packet to tcp(23) 
   From 107.0.93.58 - 9 packets to tcp(3389) 
   From 107.160.10.74 - 2 packets to tcp(3128) 
   From 107.160.36.136 - 1 packet to tcp(1433) 
   From 107.160.75.132 - 1 packet to tcp(1433) 
   From 108.167.188.32 - 4 packets to tcp(18298,21689,48188,63744) 
   From 109.120.190.127 - 2 packets to tcp(8080) 
   From 109.206.186.188 - 2 packets to tcp(8080) 
   From 109.226.227.193 - 2 packets to tcp(3389) 
   From 110.77.201.78 - 1 packet to tcp(8080) 
   From 112.95.168.15 - 4 packets to tcp(8080) 
   From 113.12.94.158 - 1 packet to tcp(8080) 
   From 113.31.139.7 - 2 packets to tcp(8080) 
   From 113.31.139.9 - 4 packets to tcp(8080) 
   From 114.33.107.182 - 3 packets to tcp(23) 
   From 115.78.128.80 - 2 packets to tcp(8080) 
   From 115.78.230.194 - 2 packets to tcp(22) 
   From 115.159.68.25 - 10 packets to tcp(8080,8123) 
   From 115.231.219.104 - 1 packet to tcp(3306) 
   From 116.6.89.59 - 1 packet to tcp(22) 
   From 116.58.240.72 - 2 packets to tcp(8080) 
   From 116.255.183.47 - 9 packets to tcp(8080) 
   From 116.255.247.197 - 1 packet to tcp(22) 
   From 117.21.174.188 - 1 packet to tcp(9200) 
   From 117.21.226.189 - 1 packet to tcp(3306) 
   From 117.184.202.20 - 8 packets to tcp(8080) 
   From 117.211.149.79 - 8 packets to tcp(8080) 
   From 117.218.157.4 - 4 packets to tcp(8080) 
   From 118.165.150.185 - 3 packets to tcp(25) 
   From 118.169.21.108 - 3 packets to tcp(25) 
   From 119.5.155.186 - 4 packets to tcp(8080) 
   From 119.133.249.96 - 3 packets to tcp(23) 
   From 119.147.143.225 - 2 packets to tcp(8080) 
   From 120.194.3.98 - 4 packets to tcp(23,1433) 
   From 121.14.27.126 - 2 packets to tcp(8080) 
   From 121.125.71.200 - 1 packet to tcp(22) 
   From 122.225.97.87 - 1 packet to tcp(22) 
   From 122.225.97.97 - 1 packet to tcp(22) 
   From 122.225.109.216 - 1 packet to tcp(22) 
   From 122.225.109.221 - 1 packet to tcp(22) 
   From 122.226.73.131 - 1 packet to tcp(8101) 
   From 124.88.60.58 - 2 packets to tcp(8080) 
   From 124.156.4.232 - 2 packets to tcp(8080) 
   From 124.156.72.47 - 1 packet to tcp(8080) 
   From 124.205.129.34 - 2 packets to tcp(23) 
   From 125.46.40.11 - 5 packets to tcp(1150,1163,1219,1245,1286) 
   From 125.46.40.12 - 2 packets to tcp(1282,1519) 
   From 125.46.40.13 - 4 packets to tcp(1364,1422,1463,1867) 
   From 125.46.40.15 - 8 packets to tcp(1137,1280,1446,1706,1711,1914,2016,2035) 
   From 125.46.40.17 - 2 packets to tcp(1718,1747) 
   From 125.46.40.19 - 5 packets to tcp(8088) 
   From 125.46.40.20 - 13 packets to tcp(1926,1946,2146,2164,2204,2217,2246,2250,2336,2500,2656,2696) 
   From 125.46.40.23 - 4 packets to tcp(8123,9000,9999,18186) 
   From 131.161.45.26 - 2 packets to tcp(8080) 
   From 134.213.57.97 - 4 packets to tcp(8080) 
   From 141.255.190.190 - 1 packet to tcp(7578) 
   From 142.4.117.195 - 1 packet to tcp(3306) 
   From 148.210.15.21 - 2 packets to tcp(3389) 
   From 153.104.12.107 - 1 packet to tcp(8080) 
   From 158.85.76.132 - 1 packet to tcp(22) 
   From 166.78.34.229 - 1 packet to tcp(13310) 
   From 167.61.29.242 - 4 packets to tcp(8080) 
   From 167.61.56.158 - 8 packets to tcp(8080) 
   From 167.62.113.159 - 2 packets to tcp(8080) 
   From 167.62.138.74 - 2 packets to tcp(8080) 
   From 172.230.104.120 - 1 packet to tcp(22398) 
   From 173.44.134.140 - 3 packets to tcp(8080) 
   From 175.195.220.111 - 6 packets to tcp(8080) 
   From 176.61.138.173 - 1 packet to tcp(9064) 
   From 177.135.176.90 - 1 packet to tcp(8080) 
   From 178.45.236.44 - 1 packet to tcp(8001) 
   From 179.111.248.138 - 1 packet to tcp(3389) 
   From 181.14.201.26 - 1 packet to tcp(8080) 
   From 181.40.95.106 - 1 packet to tcp(8080) 
   From 181.48.82.162 - 12 packets to tcp(81,8080,8081,8180,8181,9090) 
   From 182.254.141.88 - 5 packets to tcp(8123) 
   From 182.254.152.209 - 5 packets to tcp(8080) 
   From 182.254.156.80 - 5 packets to tcp(3128) 
   From 182.254.157.198 - 10 packets to tcp(3128,8123) 
   From 182.254.208.92 - 15 packets to tcp(3128,8088,8123) 
   From 183.36.68.12 - 6 packets to tcp(8080) 
   From 183.60.204.203 - 1 packet to tcp(1433) 
   From 183.69.7.37 - 1 packet to tcp(23) 
   From 184.25.56.163 - 1 packet to tcp(21249) 
   From 189.58.129.86 - 2 packets to tcp(23) 
   From 190.93.253.112 - 1 packet to tcp(5972) 
   From 190.134.90.249 - 2 packets to tcp(8080) 
   From 190.144.79.126 - 8 packets to tcp(8080) 
   From 190.173.220.65 - 1 packet to tcp(8080) 
   From 192.210.53.53 - 1 packet to tcp(3306) 
   From 193.193.243.68 - 6 packets to tcp(4899) 
   From 195.22.12.42 - 6 packets to tcp(8080) 
   From 195.154.11.8 - 1 packet to tcp(23338) 
   From 195.154.200.232 - 1 packet to tcp(39479) 
   From 195.211.154.177 - 1 packet to tcp(21320) 
   From 196.202.75.222 - 4 packets to tcp(8080) 
   From 198.20.70.114 - 4 packets to tcp(1200,2628,5985,5986) 
   From 198.50.233.144 - 24 packets to tcp(81,8080,8081,8180,8181,9090) 
   From 200.199.106.107 - 2 packets to tcp(8080) 
   From 201.39.251.50 - 6 packets to tcp(8080) 
   From 201.159.139.27 - 2 packets to tcp(8080) 
   From 202.83.25.95 - 2 packets to tcp(8080) 
   From 202.117.3.104 - 3 packets to tcp(8080) 
   From 202.190.179.48 - 2 packets to tcp(8080) 
   From 209.251.185.50 - 2 packets to tcp(8080) 
   From 211.39.140.121 - 1 packet to tcp(22) 
   From 211.90.11.25 - 4 packets to tcp(8080) 
   From 211.151.13.74 - 2 packets to tcp(8080) 
   From 212.38.181.116 - 2 packets to tcp(5900,5901) 
   From 212.38.181.118 - 1 packet to tcp(5908) 
   From 212.210.82.58 - 4 packets to tcp(8080) 
   From 212.224.101.72 - 1 packet to tcp(54502) 
   From 213.5.71.61 - 1 packet to tcp(39191) 
   From 213.152.29.100 - 6 packets to tcp(3389) 
   From 216.12.194.22 - 2 packets to tcp(8080) 
   From 216.53.166.28 - 4 packets to tcp(8080) 
   From 216.99.158.70 - 1 packet to tcp(5900) 
   From 218.2.0.120 - 1 packet to tcp(22) 
   From 218.2.0.125 - 1 packet to tcp(22) 
   From 218.2.0.132 - 1 packet to tcp(22) 
   From 218.2.0.137 - 1 packet to tcp(22) 
   From 218.77.79.38 - 9 packets to tcp(110,1433,1521,1723,3128,3306,7001,8081) 
   From 218.77.79.43 - 5 packets to tcp(21,23,25,3389,8080) 
   From 218.77.79.55 - 9 packets to tcp(49152,49153,49154,49155,49156,49157,49158,49159) 
   From 218.89.170.113 - 1 packet to tcp(8080) 
   From 218.92.244.201 - 5 packets to tcp(8080) 
   From 219.249.254.148 - 3 packets to tcp(23) 
   From 220.177.198.39 - 1 packet to tcp(22) 
   From 221.203.3.59 - 1 packet to tcp(8080) 
   From 221.234.42.75 - 2 packets to tcp(8080) 
   From 222.66.55.245 - 1 packet to tcp(1433) 
   From 222.73.178.125 - 2 packets to tcp(8080) 
   From 222.76.218.188 - 1 packet to tcp(5900) 
   From 222.186.21.202 - 3 packets to tcp(2233,5902,22222) 
   From 222.186.30.189 - 2 packets to tcp(3306) 
   From 222.186.31.196 - 1 packet to tcp(5901) 
   From 222.186.57.151 - 1 packet to tcp(8080) 
   From 222.186.128.53 - 2 packets to tcp(1024) 
 
 ---------------------- iptables firewall End -------------------------

on voit bien les tentatives pour exploiter une faille mais c'est au niveau d'iptables mon serveur reçoit pas mal de requêtes mais c'est jamais la même adresse ip, du coup fail2ban ne doit pas agir je pense, je ne sais pas comment me prémunir de ça si ça gêne vraiment le comportement du serveur.
Merci

ps : sinon quand tu disais de 'virer manuellement mes fichiers' tu parlais desquels?
Merci.