1

FileZilla log is showing regular attempts to login with dictionary keywords, and the attacker's IP remains the same for the last 3 days.

What can I do about it apart from deny this IP address?

4
  • I Updated your title - password scans are not "being hacked". They are "attepts to be hacked".
    – TomTom
    Jun 28, 2010 at 15:57
  • Wouldn't it be like probing if it's just a dictionary attack? Jun 28, 2010 at 16:04
  • Is there a reason you can't just deny the IP address? I'd be tempted to put up a honeypot and redirect that IP to the honeypot system in a secured DMZ to see what they're so eager to do with the system if they were to get in, or maybe they'd lose interest if the honeypot was a crap system or simulated dead end. Jun 28, 2010 at 16:05
  • I would love to, but beside I dun have the know-hows, I'm actually the PM, code monkey, server admin, all is on my shoulders, got quite a lot on my plate already. There are 2 other developers but they dun want to do anything non-coding related.
    – Chris
    Jun 28, 2010 at 16:09

3 Answers 3

0

Use fail2ban to ban IP addresses if you want an ongoing blocking solution. Rate limiting the logons is also a good idea if your server software supports it (I'm not sure if FileZilla's server supports it, maybe someone else can chime in).

A better idea is to make sure nobody's username or password are extremely simple (like single first names, or dictionary passwords). Proper usernames and complex passwords would take them years (at a minimum) to break.

3
  • Thank, will try out fail2ban. Luckily FileZilla does have rate limiting built-in, but the geezer came back after the ban lifted, I'm pretty sure he is using a bot or something like that.
    – Chris
    Jun 28, 2010 at 15:58
  • I highly doubt the person who owns the computer knows it's being used to hack your site; it's almost certainly malware installed on their computer.
    – Chris S
    Jun 28, 2010 at 16:47
  • I extended the limiting from 1 hour to 72, since then no sign of any potential hacking attempts. Thanks :-)
    – Chris
    Jul 2, 2010 at 15:44
0

how many people have authorised access to your FTP server? If its only a few I would apply a firewall rule to only allow the authorised user's external IP address. I think the most obviously solution is the block the IP address and maybe log an abuse ticket at the idiot's ISP. You can check the ISP of the user using the ripe database: http://www.ripe.net/ use the search box on the right.

Hope this helps you!

2
  • Thanks, I've used whois and found out the IP is from hanzhou China, not a lot one can do really I suppose when you got that. Our FTP server is FileZilla running on WS2K3, and it's the same server as our web server (IIS6), I'm feeling a bit embarrass now after I revealed both the FTP and the web server is on the same machine. It was inherited from the last guy who has left the company tho.
    – Chris
    Jun 28, 2010 at 16:04
  • Actually, I've been thinking of relocating all data files to a new server lately and this time would be FTP server only, nothing else.
    – Chris
    Jun 28, 2010 at 16:06
0

Chinese IP? Does it deserve special treatment? I don't think so. It still makes sense to send a formal complaint to their abuse mail. If you get no positive answer, well, this is a reason to block the whole ISP forever. And also submit it to any possible blacklist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .