Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

FileZilla log is showing regular attempts to login with dictionary keywords, and the attacker's IP remains the same for the last 3 days.

What can I do about it apart from deny this IP address?

share|improve this question
    
I Updated your title - password scans are not "being hacked". They are "attepts to be hacked". –  TomTom Jun 28 '10 at 15:57
    
Wouldn't it be like probing if it's just a dictionary attack? –  Bart Silverstrim Jun 28 '10 at 16:04
    
Is there a reason you can't just deny the IP address? I'd be tempted to put up a honeypot and redirect that IP to the honeypot system in a secured DMZ to see what they're so eager to do with the system if they were to get in, or maybe they'd lose interest if the honeypot was a crap system or simulated dead end. –  Bart Silverstrim Jun 28 '10 at 16:05
    
I would love to, but beside I dun have the know-hows, I'm actually the PM, code monkey, server admin, all is on my shoulders, got quite a lot on my plate already. There are 2 other developers but they dun want to do anything non-coding related. –  Chris Jun 28 '10 at 16:09

3 Answers 3

up vote 0 down vote accepted

Use fail2ban to ban IP addresses if you want an ongoing blocking solution. Rate limiting the logons is also a good idea if your server software supports it (I'm not sure if FileZilla's server supports it, maybe someone else can chime in).

A better idea is to make sure nobody's username or password are extremely simple (like single first names, or dictionary passwords). Proper usernames and complex passwords would take them years (at a minimum) to break.

share|improve this answer
    
Thank, will try out fail2ban. Luckily FileZilla does have rate limiting built-in, but the geezer came back after the ban lifted, I'm pretty sure he is using a bot or something like that. –  Chris Jun 28 '10 at 15:58
    
I highly doubt the person who owns the computer knows it's being used to hack your site; it's almost certainly malware installed on their computer. –  Chris S Jun 28 '10 at 16:47
    
I extended the limiting from 1 hour to 72, since then no sign of any potential hacking attempts. Thanks :-) –  Chris Jul 2 '10 at 15:44

how many people have authorised access to your FTP server? If its only a few I would apply a firewall rule to only allow the authorised user's external IP address. I think the most obviously solution is the block the IP address and maybe log an abuse ticket at the idiot's ISP. You can check the ISP of the user using the ripe database: http://www.ripe.net/ use the search box on the right.

Hope this helps you!

share|improve this answer
    
Thanks, I've used whois and found out the IP is from hanzhou China, not a lot one can do really I suppose when you got that. Our FTP server is FileZilla running on WS2K3, and it's the same server as our web server (IIS6), I'm feeling a bit embarrass now after I revealed both the FTP and the web server is on the same machine. It was inherited from the last guy who has left the company tho. –  Chris Jun 28 '10 at 16:04
    
Actually, I've been thinking of relocating all data files to a new server lately and this time would be FTP server only, nothing else. –  Chris Jun 28 '10 at 16:06

Chinese IP? Does it deserve special treatment? I don't think so. It still makes sense to send a formal complaint to their abuse mail. If you get no positive answer, well, this is a reason to block the whole ISP forever. And also submit it to any possible blacklist.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.