NTP reflection attack - amplification, how to check the server for vulnerabilities?

E

exp1312014-01-20 13:34:15

FreeBSD

exp131, 2014-01-20 13:34:15

Greetings.
I rent a server from Hetzner. Today I received messages from them that 3 of my servers received identical abuses on the NTP reflection - amplification attack.
One is FreeBSD 9.0-RELEASE, the other two are 9.1-RELEASE-p2.
The odd thing is that the NTPd service is disabled on all three. I specifically turned it off at the beginning of the year, because. by default they open 123 UDP port outside.
Checks
ntpdc -c monlist XX.XX.XX.XX(XX.XX.XX.XX - IP address of tested servers)
Issue: Connection refused.
Tell me where to look for the cause?
There are no web servers on all servers, only FTP is on a non-standard port, SSH is also on a non-standard port and password authorization is disabled, only by key.
Login logs only show my connections from known IPs.

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

S

Sergey, 2014-01-20
@bondbig

Write the same text to Hetzner?