The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
3answers
590 views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
-1
votes
1answer
22 views

How can I defend against malicious GET requests? [duplicate]

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
0
votes
0answers
36 views

Win2008R2: A brute-force attack even though RDP port is not forwarded to the machine

After installing Windows Server 2008 R2 I configured my edge device to forward port 3389 to that host (which only has the internal IP address), which seemed like a great idea until I registered a ...
3
votes
3answers
204 views

How can I combat all of these brute force attacks?

I have 3 dedicated servers, all running WHM/cPanel on CentOS. They're all physically located in Canada. On the newest server, cPHulk started detecting (and blacklisting) failed login attempts. It ...
-1
votes
1answer
43 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
2
votes
1answer
283 views

Outgoing brute force attacks from my server

One of the servers I look after appears to be participating in brute force attacks against Wordpress installations. I've been on the receiving end of this many times, so am very familiar with steps ...
1
vote
1answer
394 views

How to find source of 4625 Event ID in windows server 2012

I have many audit failure with event ID 4625 and Logon type 3 in my event log. Is this problem form my server(internal services or applications) ? Or this is brute force attack? Finally How can i ...
-2
votes
2answers
73 views

Automicly report brute forcing ip's [closed]

Hosting is awesome. But hackers and bots trying to break into your server are not. I actually hate them. So, today i launched a new server with directadmin. And all is great. But a few minutes after ...
1
vote
1answer
89 views

Exim undergoing distributed dictionary attack

Our web server is currently undergoing a botnet attack on Exim. Our server is CentOS and is setup with BFD (Brute Force detect that uses APF to prevent access) to detect attempts and block them. ...
0
votes
1answer
184 views

CSF not adding IPs to deny file as a cron during high loads

I'm running a cron every minute to thwart brute-force attacks. awk '{print $2}' < ipkill.txt | while read ip; do #query geographical info IP address curl -o country.txt ipinfo.io/$ip ...
-1
votes
2answers
174 views

How to null route a dns zone [closed]

I have a domain that was attacked and flooding the server apache system. The only way to detour the attack is to reroute the dns off the server. Is there a generic IP like "127.0.0.1" that I can use ...
2
votes
0answers
54 views

Incremental Subdomain Brute forcing?

Currently looking after a small varnish/nginx webserver group sitting behind an AWS ELB. Monitoring of the primary domain recently picked up a huge number of hits to non-existent sub-domain ...
-9
votes
3answers
2k views

make fail2ban use public blacklists [closed]

I've been searching high and low for a way to connect fail2ban with blocklist.de (or any other public blacklists, for that matter, as long as fail2ban can report to it). Pretty much every result that ...
3
votes
1answer
522 views

mod_security ruleset for Joomla! admin

I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page. I ...
1
vote
0answers
33 views

Server being hacked with lots of weird process [duplicate]

(I have asked same question at http://superuser.com/questions/841908/server-being-hacked-with-lots-of-weird-process and was told better to ask here, could some admin help delete the post at ...
2
votes
3answers
281 views

Solaris 11 sshd brute force protection. DenyHosts equivalent for Solaris 11

I'm getting regular attempts to brute force ssh on a x86 solaris 11.1 server. On linux I use DenyHosts to block connections after a number of incorrect login attempts. Is there a similar package for ...
0
votes
1answer
281 views

Nginx how to use limit_req_zone on auth_basic to protect against brute force attack?

I have an Nginx server that works as an SSL proxy for a service running on a localhost that doesn't support SSL authentication. I would like to use Nginx's limit_req_zone function to protect the ...
0
votes
1answer
124 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
0
votes
1answer
118 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
-2
votes
1answer
94 views

Multiple attacks - what can I do

I experience multiple attacks on my server recently (for past several days). Types of these attacks are e.g.: Several SQL Injection methods (select/union/where/null, etc.) Brute force attacks (e.g. ...
0
votes
1answer
137 views

Deal with brute force ftp attack [duplicate]

While Checking the /var/log/secure on my centos server have found lot of attempts of failed login by using unknown usernames, from a list of ip from Japan And China How to hide my server from these ...
0
votes
1answer
539 views

block internal ip brute force attack

Here's someone doing a bruteforce attack on my server for several days now, each time through a different external IP address (hundreds so far) but always through the same I assume local IP address: ...
0
votes
1answer
784 views

htpasswd - Any tip to block brute force attacks?

Update: As Craig suggested I'm trying fail2ban now. Even though I have issues in that as well. failregex is not finding any result though. I had enabled all apache* in jail.local and here is how my ...
3
votes
2answers
209 views

What is the optimum ban duration of a brute force attack?

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is ...
0
votes
2answers
864 views

SSH attacks on Freenas [closed]

I had my freenas box set up using no-ip to forward ssh requests to my machine so that I could get to it from work, friends house, parents, etc. A couple days ago i noticed a large in crease in ...
0
votes
0answers
274 views

Brute force attack on my servers ports burning through bandwidth

Am having some form of brute force attack being done to my server and I have a screenshot of what's happening below. Remote Address 121.14.154.206 is somehow abusing all of my ports and burning ...
4
votes
2answers
9k views

How to stop/prevent SSH bruteforce

I'm very new to network administration, so please regard that I'm not that experienced yet. I have a Ubuntu root server with plesk panel. Yesterday my friends and I noticed that the quality of ...
3
votes
1answer
2k views

User account was locked out from exchange server - how to prevent in future?

I had a bizarre instance this morning and I'm hoping someone can help me shed some light as to what's happened. A user complained about being locked out this morning. After resetting the password, ...
1
vote
1answer
2k views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
1
vote
1answer
161 views

ldap ppolicy implementation for brute force prevention

I have an openldap server (with user passwords) open worldwide which I'm trying to secure. Step 1 was to limit access to data to authenticated users via ACLs. Step 2, to prevent brute force attacks, ...
2
votes
2answers
2k views

How to stop or prevent Postfix / smtpd / Sasl brute forcing

There are numerous attempts to connect to my mail server in order to send mail either unauthenticated or to guess username and password to, I suppose, accomplish the same. Should I fight against ...
2
votes
0answers
463 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
3
votes
1answer
115 views

Ban IP Address on unsuccessful login on Server 2003

I'm regularly under brute force attacks on my Windows Server 2003 with Citrix installed. How can I automatically ban IP addresses that have several unsuccessful login attempts ? This question has ...
1
vote
1answer
163 views

Constant brute force attack on specific email addresses

I have a bit of an issue, this has caught my attention yesterday. Someone or something, a botnet I presume, has been trying to gain access to specific e-mail addresses. The server software keeps ...
0
votes
1answer
167 views

Ubuntu 10.04LTS Server under attack, random reboots UNTIL I blocked China

What could have been sent to my server to cause it to reboot? Details: I have a for-internal-use LAMP server running Ubuntu 10.04LTS (upgrade is scheduled for that nebulous "when I have time"). It ...
5
votes
1answer
4k views

How to Blacklist a Range of IPs in cPHulk Brute Force Attack Settings [closed]

Does anyone know how to define a range of IPs to blacklist in the cPHulk Brute Force attack settings? I am getting bombarded from IPS 103.26.193.* and 103.26.194.* I Googled it and cannot find ...
2
votes
2answers
1k views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
6
votes
3answers
23k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
0
votes
1answer
2k views

Do cPHulk Brute Force Protection Settings Effect Hosts? [closed]

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
1
vote
1answer
511 views

Apache Error log showing File webdav,wp-login.php does not exist- Possible Attack

Apache Error Log shows the following messages. Seems like an attack to me But not sure what it means. Can anyone tell me what are these attacks and how to prevent any damage from such attacks [Wed ...
1
vote
1answer
169 views

How to I reset the false attempt login counter of iptable after a successful login?

I added the following firewall rules in order to defend against ssh attacks. iptables -N LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7 iptables -A LOGNDROP -j DROP ...
1
vote
3answers
440 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
0
votes
1answer
224 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
2
votes
2answers
400 views

Multiple IP Brute Force Login Attack CentOS 6

Currently, one of my websites is being subject to a brute force login attempt. The problem is that it is coming form multiple IP sources. I have a system that auto bans IP after 3 attempts and so ...
1
vote
1answer
457 views

TS_Block and Windows 2008

I am running a Windows 2008 Server and I have installed ts_block on it to help block RDP brute force attempts on the server. Question 1: What I wanted to know is there any benefit for me using ...
0
votes
1answer
90 views

Brute Force Attacks - What Else Can I Do?

I am running a Windows 2008 Server which is racked in a data center. Over the last week I have noticed a lot of attempts to brute force login to the box via RDP. Here is what I have in place: Win ...
1
vote
3answers
367 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
3
votes
5answers
525 views

Is it typical to get brute force attack attempts on a brand new server?

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
0
votes
1answer
218 views

Preventing logon type 2 and 3 attacks on VPS

Sorry if this was asked before, but I've looked at other questions and couldn't find a match. I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). ...
2
votes
4answers
474 views

Is this a 'port scan'?

Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...