Server goes totally jammed

Question

Hi
I'm running OS X Server 10.4.9 on a Mac Pro as a standalone server. Services enabled are: AFP, FTP, Firewall & Windows. The server also runs Retrospect Workgroup -backup server.
The problem is that occasionally - every two days, sometimes even a couple of times a day - the server goes totally jammed up: existing network connections slow down a lot or disconnect, new logins aren't possible because the server
can't be found. You can't even login using ssh.
Local login doesn't work either - when waking up the computer from screen saver, you wont even get the login window and the screen refreshes about 1frame / 10 sec. Hard drives are then working like crazy, when there shouldn't be anything particularily heavy going on.
So the only solution is to boot it using the power switch.
The situation is totally unbearable. Haven't found anything obvious reason from the logs. Anyone with any idea?
Mac OS X (10.4.9)

Answer 1

Hi: I’m not criticising it just seems curious as why only that?
Umm... Isn't that just normal? The server has a
public ip, and it's being accessed remotely by our
employees.
If you are going to be using your server as a gateway/router then it makes sense. NAT, DHCP & DNS and possibly VPN would have be to enabled. If everything sits behind a router based firewall then there is not much point. Judging by what you say: is remote access via command line and ssh or by VPN? If its via VPN then obviously its not your server handling it. Routers that support VPN connections will have Firewall/NAT built in and these will be active.
Again why the Firewall on the server as it does not seem to be doing anything?
BTW - Server logs show these kind of login attempts
every now and then:
DirectoryService[76]: Failed Authentication
return is being delayed due to over five recent auth
failures for username: admin
Something to be worried about? There's no signs that
someone would have succeeded with those...
Absolutely. This could indicate a dictionary attack or possibly a failed login attempt locally. If you are the Server Administrator and you know your user base does not have command line knowledge then I would be suspicious. When you install OSX Server Remote Login is enabled by default. This allows for ssh connections to be made by administrators who wish to administer the server remotely and by the command line. Unless you have an absolute requirement to do this you should disable it. System Preferences > Sharing > Remote Login.
By default Root User is not enabled on OSX Client. It is on OSX Server. Again unless you have an absolute requirement to have this enabled, disable it. If you need to enable Root User for a specific purpose then you can re-enable it for that purpose, disabling it when you are done. /Applications/Utilities/Net Info Manager. Click the lock and authenticate, Security Menu > Disable Root User. Inspect your router and make sure that Port 22/23 are not open. Some Routers open these to allow for Remote Management.
I’m not an expert on this, but as I understand it hackers know this and use dictionary attacks (a brute force method that assumes that admin is the user name and tries numerous passwords until it hits on the right one) to gain access to your server. Again I am not an expert at this but what they do when they get there – generally – is leave something like a timed script that sends spam in one huge chunk. The Server reacts by allocating as much system resources and CPU time as it can to deal with the traffic, this can appear as if the Server has been jammed causing disconnects and unstable access.
Launch terminal and issue the top command. This will list all active processes running. Look at for amavisd or clamav and see what CPU usage is for these processes when the slow down occurs. This would be an indication that your server has been hacked and is being used to send spam. You can stop these processes by issuing sudo kill PID, where PID is the Process ID number. Alternatively if you are not comfortable with the command line you can use Activity Monitor in /Applications/Utilities folder. It’s the GUI for top.
Don’t worry and don’t panic, if you follow these basic security procedures you will be OK even if it turns out to be not a dictionary attack, these are still good best practice methods to employ.
One further question for you: have you had to reset the password for the Server Administrator account lately?
Hope this helps – Tony