FileZilla log is showing regular attempts to login with dictionary keywords, and the attacker's IP remains the same for the last 3 days.
What can I do about it apart from deny this IP address?
FileZilla log is showing regular attempts to login with dictionary keywords, and the attacker's IP remains the same for the last 3 days.
What can I do about it apart from deny this IP address?
Use fail2ban to ban IP addresses if you want an ongoing blocking solution. Rate limiting the logons is also a good idea if your server software supports it (I'm not sure if FileZilla's server supports it, maybe someone else can chime in).
A better idea is to make sure nobody's username or password are extremely simple (like single first names, or dictionary passwords). Proper usernames and complex passwords would take them years (at a minimum) to break.
how many people have authorised access to your FTP server? If its only a few I would apply a firewall rule to only allow the authorised user's external IP address. I think the most obviously solution is the block the IP address and maybe log an abuse ticket at the idiot's ISP. You can check the ISP of the user using the ripe database: http://www.ripe.net/ use the search box on the right.
Hope this helps you!
Chinese IP? Does it deserve special treatment? I don't think so. It still makes sense to send a formal complaint to their abuse mail. If you get no positive answer, well, this is a reason to block the whole ISP forever. And also submit it to any possible blacklist.