Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking for module which will put ProFTPD brute-forcing ip address into hosts.deny. Say if 3 times password was incorrect, ban it from server, preventing to try other services.

share|improve this question
I suggest you look at doing this at the firewall level for any service, rather than just for FTP. – John Gardeniers Mar 16 '11 at 19:09

If your not adverse to installing other tools than you could use something like Fail2Ban

share|improve this answer

Have a look at

  MaxLoginAttempts 1

  <IfModule mod_ban.c>
    BanEngine on
    BanLog /var/log/proftpd/ban.log
    BanTable /var/data//proftpd/

    # If the same client reaches the MaxLoginAttempts limit 2 times
    # within 10 minutes, automatically add a ban for that client that
    # will expire after one hour.
    BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00

    # Allow the FTP admin to manually add/remove bans
    BanControlsACLs all allow user ftpadm
share|improve this answer
This will not block ip address from connection, hence there is a risk that attacker will try brute-force another services. That's why I was looking for some way to block his ip from connecting to server at all. – Michael Mar 16 '11 at 16:34
Sorry I misread your querstion. Have a look at… and – Kyle Hudson Mar 16 '11 at 16:41

iptables can do this without the need to install any additional software, or reconfigure underlying services.

share|improve this answer

You can also try BFD which works with both APF and CSF.

See this for an example scenario.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.