Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking for module which will put ProFTPD brute-forcing ip address into hosts.deny. Say if 3 times password was incorrect, ban it from server, preventing to try other services.

share|improve this question
    
I suggest you look at doing this at the firewall level for any service, rather than just for FTP. –  John Gardeniers Mar 16 '11 at 19:09

4 Answers 4

If your not adverse to installing other tools than you could use something like Fail2Ban

share|improve this answer

Have a look at http://www.proftpd.org/docs/contrib/mod_ban.html

  MaxLoginAttempts 1

  <IfModule mod_ban.c>
    BanEngine on
    BanLog /var/log/proftpd/ban.log
    BanTable /var/data//proftpd/ban.tab

    # If the same client reaches the MaxLoginAttempts limit 2 times
    # within 10 minutes, automatically add a ban for that client that
    # will expire after one hour.
    BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00

    # Allow the FTP admin to manually add/remove bans
    BanControlsACLs all allow user ftpadm
  </IfModule>
share|improve this answer
    
This will not block ip address from connection, hence there is a risk that attacker will try brute-force another services. That's why I was looking for some way to block his ip from connecting to server at all. –  Michael Mar 16 '11 at 16:34
    
Sorry I misread your querstion. Have a look at kevin.vanzonneveld.net/techblog/article/… and thebuzzmedia.com/using-fail2ban-to-prevent-brute-force-attacks –  Kyle Hudson Mar 16 '11 at 16:41

iptables can do this without the need to install any additional software, or reconfigure underlying services.

share|improve this answer

You can also try BFD which works with both APF and CSF.

See this for an example scenario.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.