The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
3answers
51 views

Solaris 11 sshd brute force protection. DenyHosts equivalent for Solaris 11

I'm getting regular attempts to brute force ssh on a x86 solaris 11.1 server. On linux I use DenyHosts to block connections after a number of incorrect login attempts. Is there a similar package for ...
0
votes
0answers
57 views

Nginx how to use limit_req_zone on auth_basic to protect against brute force attack?

I have an Nginx server that works as an SSL proxy for a service running on a localhost that doesn't support SSL authentication. I would like to use Nginx's limit_req_zone function to protect the ...
0
votes
1answer
50 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
0
votes
1answer
48 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
-2
votes
1answer
54 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
0
votes
1answer
37 views

Deal with brute force ftp attack [duplicate]

While Checking the /var/log/secure on my centos server have found lot of attempts of failed login by using unknown usernames, from a list of ip from Japan And China How to hide my server from these ...
0
votes
1answer
103 views

block internal ip brute force attack

Here's someone doing a bruteforce attack on my server for several days now, each time through a different external IP address (hundreds so far) but always through the same I assume local IP address: ...
0
votes
1answer
148 views

htpasswd - Any tip to block brute force attacks?

Update: As Craig suggested I'm trying fail2ban now. Even though I have issues in that as well. failregex is not finding any result though. I had enabled all apache* in jail.local and here is how my ...
4
votes
2answers
113 views

What is the optimum ban duration of a brute force attack?

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is ...
0
votes
2answers
115 views

SSH attacks on Freenas [closed]

I had my freenas box set up using no-ip to forward ssh requests to my machine so that I could get to it from work, friends house, parents, etc. A couple days ago i noticed a large in crease in ...
0
votes
0answers
84 views

Brute force attack on my servers ports burning through bandwidth

Am having some form of brute force attack being done to my server and I have a screenshot of what's happening below. Remote Address 121.14.154.206 is somehow abusing all of my ports and burning ...
1
vote
1answer
365 views

How to prevent brute force attacks on exim service through csf?

It's 3rd days that my VPS has too many brute force attacks on exim. Server features: CentOS 6 64-bit, CSF 7.03, DirectAdmin 1.43.3 I would like to stop these attacks. But I don't know what is the best ...
2
votes
2answers
779 views

How to stop/prevent SSH bruteforce

I'm very new to network administration, so please regard that I'm not that experienced yet. I have a Ubuntu root server with plesk panel. Yesterday my friends and I noticed that the quality of ...
3
votes
1answer
616 views

User account was locked out from exchange server - how to prevent in future?

I had a bizarre instance this morning and I'm hoping someone can help me shed some light as to what's happened. A user complained about being locked out this morning. After resetting the password, ...
1
vote
1answer
296 views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
1
vote
1answer
84 views

ldap ppolicy implementation for brute force prevention

I have an openldap server (with user passwords) open worldwide which I'm trying to secure. Step 1 was to limit access to data to authenticated users via ACLs. Step 2, to prevent brute force attacks, ...
-1
votes
1answer
139 views

Cpanel + CSF + suPHP = no php brute force protection?

I have NOT found anyone else talking about brute force detection in CSF with suPHP enabled. Maybe I'm not seeing the real picture or need but it feels that suPHP is weak at brute force detection. Is ...
0
votes
2answers
446 views

How to stop or prevent Postfix / smtpd / Sasl brute forcing

There are numerous attempts to connect to my mail server in order to send mail either unauthenticated or to guess username and password to, I suppose, accomplish the same. Should I fight against ...
2
votes
0answers
337 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
3
votes
1answer
78 views

Ban IP Address on unsuccessful login on Server 2003

I'm regularly under brute force attacks on my Windows Server 2003 with Citrix installed. How can I automatically ban IP addresses that have several unsuccessful login attempts ? This question has ...
1
vote
1answer
116 views

Constant brute force attack on specific email addresses

I have a bit of an issue, this has caught my attention yesterday. Someone or something, a botnet I presume, has been trying to gain access to specific e-mail addresses. The server software keeps ...
0
votes
0answers
49 views

new attacks from banned IPs in CSF

I have many blocked IPs in csf with "do not delete" comment. But every day I got notifications from server about new brute force attacks via some of these IPs. When I want to add the attacker IP to ...
0
votes
0answers
368 views

How to set csf to block brute force attacker's IP beside DirectAdmin settings?

I have a VPS with CentOS, DirectAdmin and CSF. This is what I have set in DirectAdmin: But as I talked with DirectAdmin support team, when CSF is installed on the server, these settings don't ...
0
votes
1answer
108 views

Ubuntu 10.04LTS Server under attack, random reboots UNTIL I blocked China

What could have been sent to my server to cause it to reboot? Details: I have a for-internal-use LAMP server running Ubuntu 10.04LTS (upgrade is scheduled for that nebulous "when I have time"). It ...
1
vote
1answer
1k views

How to Blacklist a Range of IPs in cPHulk Brute Force Attack Settings

Does anyone know how to define a range of IPs to blacklist in the cPHulk Brute Force attack settings? I am getting bombarded from IPS 103.26.193.* and 103.26.194.* I Googled it and cannot find ...
1
vote
2answers
283 views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
3
votes
2answers
6k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
0
votes
1answer
760 views

Do cPHulk Brute Force Protection Settings Effect Hosts?

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
1
vote
1answer
397 views

Apache Error log showing File webdav,wp-login.php does not exist- Possible Attack

Apache Error Log shows the following messages. Seems like an attack to me But not sure what it means. Can anyone tell me what are these attacks and how to prevent any damage from such attacks [Wed ...
1
vote
1answer
110 views

How to I reset the false attempt login counter of iptable after a successful login?

I added the following firewall rules in order to defend against ssh attacks. iptables -N LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7 iptables -A LOGNDROP -j DROP ...
1
vote
3answers
199 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
0
votes
0answers
20 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
0
votes
1answer
133 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
2
votes
2answers
246 views

Multiple IP Brute Force Login Attack CentOS 6

Currently, one of my websites is being subject to a brute force login attempt. The problem is that it is coming form multiple IP sources. I have a system that auto bans IP after 3 attempts and so ...
1
vote
1answer
292 views

TS_Block and Windows 2008

I am running a Windows 2008 Server and I have installed ts_block on it to help block RDP brute force attempts on the server. Question 1: What I wanted to know is there any benefit for me using ...
0
votes
1answer
83 views

Brute Force Attacks - What Else Can I Do?

I am running a Windows 2008 Server which is racked in a data center. Over the last week I have noticed a lot of attempts to brute force login to the box via RDP. Here is what I have in place: Win ...
1
vote
3answers
253 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
3
votes
5answers
391 views

Is it typical to get brute force attack attempts on a brand new server?

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
0
votes
1answer
109 views

Preventing logon type 2 and 3 attacks on VPS

Sorry if this was asked before, but I've looked at other questions and couldn't find a match. I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). ...
2
votes
4answers
466 views

Is this a 'port scan'?

Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...
1
vote
0answers
110 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
0
votes
1answer
254 views

SSHGuard - Configure netfilter/iptables

I have a question about the setting up/modus operandi of SSHGuard. I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login ...
0
votes
2answers
97 views

Dealing with brute force on RHEL

Box got slow and decided to vim /var/log/secure and saw a bunch of brute force methods trying to ssh with names starting from A-Z. iptables was installed so I added the ip via: iptables -I FORWARD ...
0
votes
2answers
210 views

how to identify & respond to bruteforce attacks

(skip to the end for less context) I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get ...
-1
votes
1answer
132 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
2
votes
1answer
378 views

ldap prevent brute force

The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks. It would be fine to prevent password guessing by locking a password for ...
1
vote
1answer
491 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
0
votes
1answer
142 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
3answers
204 views

How to stop failed login attempts by a domain

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
3
votes
1answer
141 views

Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?

Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...