Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I use blockhosts to block IP addresses trying to brute force the plesk admin login page?

I know we can add custom rules and logs to blockhosts, but I don't see anywhere that plesk logs failed authentication attempts.

has anyone done this? [or know of a better way?]

share|improve this question

1 Answer 1

You can restrict admin login to specific IP addresses with the control panel itself, go to Tools & Settings (in Plesk 10 or 11), and under the panel section you will see 'Restrict Administrative Access'. This only affects the administrator login not regular client, domain or lower levels of access. I realise this is not really the question you are asking but it may be relevant to your problem.

I'm not familiar with blockhosts myself (is it Debian based?) but depending on your platform you might find value in fail2ban and denyhosts.

Plesk logs failed logins into a MySQL table which you can download via the control panel under Tools and Settings -> Panel -> Action Log. A failed login gets a line similar to this:

85.123.123.123  [2012-12-14 10:11:32] 'CP User Login Attempt Failed' ('Login Name': 'admin' => '')

via the action log which is extracted from two tables.

You might be able to write something to connect these tables (log_actions and log_components) in the psa database to a suitable blocking script.

For a more complete solution you might investigate Atomic Secured Linux which does provide bruteforce protection for most services. I've not checked if it covers the Plesk login page though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.