Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this is more and more typical in general, but...

My question is whether or not it's typical and/or something to be concerned about when it happens on a brand new server?

Note: I'm not asking how to defend against brute force attacks (e.g., using strong passwords and possibly removing ssh access by password authentication).

share|improve this question
up vote 1 down vote accepted

If a server's IP is accessible to the internet, it'll see attacks. Worms etc. crawl the publicly available IP space for victims, and on a VPS host there's a good chance your IP was another known server until recently.

Installing fail2ban or denyhosts to block brute force attempts is a pretty common step.

share|improve this answer
Thanks. I've got cPHulk running (, which I assume is similar to denyhosts. – technoTarek Apr 29 '13 at 15:30
Looks like it, yep. – ceejayoz Apr 29 '13 at 15:38

Yes. This sort of thing is just part of the "background noise" of having an internet-connected system.

Disable root login via ssh and turn off password authentication in your sshd_config (using key auth instead), and you should be sufficiently safe from brute force attacks.

share|improve this answer

Yes, it's typical. Basically any system in the internet is constantly under some kind of attack. Usually, it's just considered background noise unless you have a large number of attempts.

share|improve this answer

As your server is cpanel server and by default it provides Brute Force Protection. Have you enabled "cPHulk" on your server, it protect your server from brute force. For more details you can read this

share|improve this answer
He posted that he's running that in the comments. – ceejayoz Apr 29 '13 at 16:53

Lots of software calls home with the IP Address then people get their hands on the information and try and hack into the servers. This is fairly common I would contact your hosting provider and ask for assistance.

share|improve this answer
This has nothing to do with it. While this may be true for desktop/workstation software, there is very little server software that "phones home". As mentioned in my answer, traffic like this is just part of being on the internet. – EEAA Apr 30 '13 at 0:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.