The brute-force-attacks tag has no wiki summary.
0
votes
5answers
77 views
Is it typical to get brute force attack attempts on a brand new server?
I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
0
votes
1answer
49 views
Preventing logon type 2 and 3 attacks on VPS
Sorry if this was asked before, but I've looked at other questions and couldn't find a match.
I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). ...
0
votes
0answers
86 views
postfix attack using unknown command
I'm not exactly sure how to ask this question, but my postfix mail server endured some form of an attack Sunday morning. Every 3 seconds for about 5 minutes someone connected and ran 1 command, all ...
2
votes
4answers
438 views
Is this a 'port scan'?
Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...
1
vote
0answers
59 views
Fail2ban on Ubuntu 11.10 does not ban custom filter/jail
An application I'm running logs incorrect logins such as this:
Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere !
Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere !
Tue, 19 Mar 13 ...
0
votes
1answer
49 views
SSHGuard - Configure netfilter/iptables
I have a question about the setting up/modus operandi of SSHGuard.
I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login ...
0
votes
2answers
80 views
Dealing with brute force on RHEL
Box got slow and decided to vim /var/log/secure and saw a bunch of brute force methods trying to ssh with names starting from A-Z.
iptables was installed so I added the ip via:
iptables -I FORWARD ...
0
votes
2answers
88 views
how to identify & respond to bruteforce attacks
(skip to the end for less context)
I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get ...
-1
votes
1answer
94 views
list of IPs that are source of brute force attacks [closed]
I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now.
I've compiled a list of IP addresses that are sources of this ...
2
votes
1answer
86 views
ldap prevent brute force
The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks.
It would be fine to prevent password guessing by locking a password for ...
1
vote
1answer
100 views
How should I manually add IP addresses to denyhosts?
I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it?
I want to manually ...
-2
votes
1answer
128 views
How can HAProxy improve availibility, or “how can I prevent my site from going down”? [closed]
I am aware of what HAProxy does, but what if my HAproxy goes down?
Or what if my DNS servers go down? Yes, dns is less the problem. However dns only solves to an IP and an IP is announced via BGP to ...
0
votes
0answers
83 views
Website slowed down, possible DDOS attack
I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
3answers
120 views
How to stop failed login attempts by a domain
I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
3
votes
1answer
113 views
Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?
Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...
1
vote
1answer
134 views
What's the right way to block brute force of HTTP basic auth?
Here's my thought,
Set a threshold like 30 times in a minute, then block this IP for a few minutes.
But If the attacker forge the source IP address, this could block legitimate user immediately.
...
2
votes
2answers
271 views
Block brute-force attack using lastb and iptables
Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
6
votes
3answers
365 views
Prevent SSH attacks
I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing ...
1
vote
1answer
427 views
Suspected brute force attack [closed]
Recently I acquired a dedicated server from a local ISP to play around with.
As the tags suggest, its a windows server 2008 R2 machine.
I've only had it for a few days, and no real traffic is going ...
0
votes
1answer
213 views
Is there any conflict between DirectAdmin Brute force monitor and LFD?
Is there any conflict between DirectAdmin Brute force monitor and LFD?
any help appreciated.
-1
votes
1answer
202 views
Why can't I add two '…-m recent --update --hitcount…' rules to iptables chain?
To stop brute force attacks on my server (OS is CentOS 6) I want to
block for 1 minute everyone who makes more than 4 login attempts during last minute
block for 1 day everyone who makes more than ...
0
votes
2answers
146 views
What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]
I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
0
votes
1answer
85 views
Virtualbox crash is that mean my server got attack?
I'm kind of confused right now recently my friend who also take care of the server got an email from the DirectAdmin say that we got Brute-Attack with one of the IP from Italy, but I didn't get a ...
-1
votes
2answers
143 views
How to prevent Brute-Fource server attack on Linux base server?
Lately my server goes down many times and I have to reboot it in order to start up again.
I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
-1
votes
1answer
212 views
Is cpHulk known to exhaust system resources, to the point of oom-killer getting called?
This issue started happening a week after I got a server upgrade, from iWeb. The new IPs that were assigned to me, were on some massive hacker/botnet list; so, for the first while I was getting insane ...
1
vote
2answers
355 views
How to protect ejabberd from bruteforce attacks?
It writes this in logs:
=INFO REPORT==== 2012-03-14 17:48:54 ===
I(<0.467.0>:ejabberd_listener:281) : (#Port<0.4384>) Accepted connection {{10,254,239,2},51986} -> ...
5
votes
3answers
1k views
Rate limiting with UFW: setting limits
UFW's man page mentions that it can setup iptables rate limiting for me:
ufw supports connection rate limiting, which is useful for
protecting
against brute-force login attacks. ufw ...
0
votes
3answers
2k views
Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause
This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
3answers
551 views
SSH Brute Force Attack; Auto-Ban IP-Addresses [duplicate]
Possible Duplicate:
Preventing brute force attacks against ssh?
We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH ...
1
vote
1answer
124 views
Which password entropy for MS-CHAPv2
I am looking at connecting in a reasonably secured way mobiles to an enterprise WiFi network.
The current solutions would be user certificates on the mobiles (they are unfortunately exportable) or ...
-4
votes
1answer
194 views
Wich module to defend my apache server?
Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack?
Server version: Apache/2.2.17 (Win32)
...
1
vote
1answer
129 views
Troubleshooting potential compromised server from Brute Force SSH Attack [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
So I noticed some files/folders on my webserver and investigating leads the fact that a brute force attack via SSH was done on my ...
1
vote
1answer
363 views
Does enabling cPHulk from within WHM protect my entire server?
So I have enabled cPHulk on my web server, and just realized now that somebody (most likely a bot) is attempting to brute force their way into my WHM, thus leaving me out as well.
I was shown this ...
0
votes
1answer
2k views
Block brute force attack via Remote Desktop Protocol [duplicate]
Possible Duplicate:
Ban, slowdown or stop massive login attempts to RDP
I have a Windows 2008 Server which is being attacked very hard.
Somebody is trying to use brute force to sign in to ...
0
votes
2answers
258 views
How to use RegEx for mod_security
I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1
/website1/login.php
/website2/login.php
/website3/login.php
/websiteN/login.php
...
3
votes
1answer
303 views
How can I stop brute force with IIS6 basic http authentication?
Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
3
votes
2answers
459 views
Fighting Off Network Flooding
my website sometimes gets attacked by people. You can see such an attack at 18:00 and later on a bigger attack at 22:30. Basicly the servers network card gets flooded by incoming requests.
My ...
1
vote
3answers
1k views
Why isn't fail2ban blocking failures?
This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing).
2011-07-06 01:48:16,249 ...
4
votes
4answers
798 views
What should I do if I find someone is brute forcing my server password?
I just checked the eventlog on my vps and found that someone is brute forcing both my sql server sa password and windows administrator password. (I have changed the account name from Administrator to ...
3
votes
3answers
765 views
Win2008R2 :Brute force attack prevention
I am using Windows 2008 R2.
I am wondering if there is any way to block a brute force attack.
I seeked here and there and I could not find a way to block an IP address after its makes some failing ...
1
vote
3answers
871 views
Attempt to access SQL Server with the user SA
I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins 3 attempts in SQL Server?
Moreover, I would like to block an IP, how can I ...
4
votes
1answer
126 views
Attempt to access SQL Server with the user SA [duplicate]
Possible Duplicate:
Attempt to access SQL Server with the user SA
I'm suffering an attempted invasion by brute force.
A bot is trying to figure out the sa password. How do I restrict logins ...
1
vote
1answer
299 views
Preventing Sendmail Brute Force Attack on Solaris 10
I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit ...
3
votes
4answers
321 views
Web server minimum password security based on 100 attempts per second
This insightful article proposes that passwords don't need to be very secure:
http://www.baekdal.com/tips/password-security-usability?
There is one specific line in here that I find troubling:
...
2
votes
1answer
1k views
How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?
How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
1
vote
3answers
287 views
iis' basic authentication system blocks too many login attempts?
I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
7
votes
4answers
12k views
How to stop brute force attacks on Terminal Server (Win2008R2)?
I'm more familiar with Linux tools to stop brute force attacks, so I'm having trouble finding suitable tools for Windows. I'm running a Windows Server 2008 R2 with Terminal Server, and I'd like to ...
4
votes
2answers
2k views
How to secure Outlook Web Access against Brute Force attack?
I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout.
What is the best way to do this?
I have the following group policy:
Computer ...
6
votes
4answers
666 views
SSH public key authentication — always require users to generate their own keypair?
I was working with a partner today that I needed to upload files to my server using scp. I have passwords turned off in the server's SSH configuration, so I wanted them to use public key ...
3
votes
3answers
5k views
How to thwart PHPMyAdmin attacks?
We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
