Question: We have a production issue with only one of our servers and have correlated slow performance to an abundance of sockets in the `TIME_WAIT` state. Without drawing this question into a huge backstory, we basically know that every time the server is slow, about 80% of the server's sockets are in this `TIME_WAIT` state, which of course we see by running a `netstat`). Specifically, because `TIME_WAIT` times out and go away, when our server is slow we see these `TIME_WAIT`s crop up very frequently (about ever 5 - 10 minutes).

I did a little digging and see that `TIME_WAIT`s occur when the server closes an active connection but keeps it around in case any delayed packets come through. Eventually `TIME_WAIT` times out.

Anyway to see exactly why an individual socket went into the `TIME_WAIT` state to begin with? This is CentOS 5 - does Linux log this info in `var/logs` anywhere, or is there any way to do a tcpdump and look for a specific pattern that leads to a `TIME_WAIT`? Thanks in advance.

Answer: 
"Most human activities have an inherent risk: Walking on a sidewalk exposes you to several
risks, such as an asteroid falling from space and striking you, or slipping on a banana skin
and falling. Of course, the first risk is rare and, although the second risk is more likely, its consequences are not high. Moreover, by carefully watching where you step, you can reduce the consequences of the banana-skin scenario. These two examples show that not all risks are identical, and some risks can be controlled" - Eric Vyncke, Christopher Paggen „LAN Switch Security. What Hackers know about your switches”, Cisco Press Indianapolis 2008.

Above example illustrates a situation in which you are. Everything is risky, but with proper risk analisys and risk control managment you can prevent from some dangerous situations or bring the potential damage to an acceptable level.

Opening your ssh to the internet globaly is not safe. But if you must do this, make some steps to make your ssh configurations as harden as you can. 

* Don't use standart port for ssh, change port to some not standart port.
* Don't allow root login!
* Use AllowUsers directive to define who can login via ssh.
* Use only v2 ssh protocol.
* Install fail2ban for preventing brute force attacks for your ssh password.
* If you are login only from one or few locations then you can make proper iptables rules that will allow login to ssh only from those location.
* Use key authentication
* Use both password(with strong password) and key authentication
* Protect your key file
* Keep your system up-to-date
* If you must use password based authentication make password realy hard
* Use different password for your normal user and different for root!
* U can use port knocking <http://en.wikipedia.org/wiki/Port_knocking>

Thats only some rules that will make your ssh safety to an acceptable level.
If you are doing a basic SSH connection to the host, you should have nothing to worry about. There are ways to create reverse tunnels with SSH that could expose your network to them, but that would require explicit action from you.