The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
43 views

Brute force attack on my servers ports burning through bandwidth

Am having some form of brute force attack being done to my server and I have a screenshot of what's happening below. Remote Address 121.14.154.206 is somehow abusing all of my ports and burning ...
1
vote
1answer
81 views

How to prevent brute force attacks on exim service through csf?

It's 3rd days that my VPS has too many brute force attacks on exim. Server features: CentOS 6 64-bit, CSF 7.03, DirectAdmin 1.43.3 I would like to stop these attacks. But I don't know what is the best ...
2
votes
1answer
197 views

How to stop/prevent SSH bruteforce

I'm very new to network administration, so please regard that I'm not that experienced yet. I have a Ubuntu root server with plesk panel. Yesterday my friends and I noticed that the quality of ...
3
votes
1answer
163 views

User account was locked out from exchange server - how to prevent in future?

I had a bizarre instance this morning and I'm hoping someone can help me shed some light as to what's happened. A user complained about being locked out this morning. After resetting the password, ...
1
vote
1answer
73 views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
1
vote
1answer
50 views

ldap ppolicy implementation for brute force prevention

I have an openldap server (with user passwords) open worldwide which I'm trying to secure. Step 1 was to limit access to data to authenticated users via ACLs. Step 2, to prevent brute force attacks, ...
-1
votes
1answer
79 views

Cpanel + CSF + suPHP = no php brute force protection?

I have NOT found anyone else talking about brute force detection in CSF with suPHP enabled. Maybe I'm not seeing the real picture or need but it feels that suPHP is weak at brute force detection. Is ...
0
votes
2answers
140 views

How to stop or prevent Postfix / smtpd / Sasl brute forcing

There are numerous attempts to connect to my mail server in order to send mail either unauthenticated or to guess username and password to, I suppose, accomplish the same. Should I fight against ...
2
votes
0answers
180 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
3
votes
1answer
65 views

Ban IP Address on unsuccessful login on Server 2003

I'm regularly under brute force attacks on my Windows Server 2003 with Citrix installed. How can I automatically ban IP addresses that have several unsuccessful login attempts ? This question has ...
1
vote
1answer
89 views

Constant brute force attack on specific email addresses

I have a bit of an issue, this has caught my attention yesterday. Someone or something, a botnet I presume, has been trying to gain access to specific e-mail addresses. The server software keeps ...
0
votes
0answers
39 views

new attacks from banned IPs in CSF

I have many blocked IPs in csf with "do not delete" comment. But every day I got notifications from server about new brute force attacks via some of these IPs. When I want to add the attacker IP to ...
0
votes
0answers
179 views

How to set csf to block brute force attacker's IP beside DirectAdmin settings?

I have a VPS with CentOS, DirectAdmin and CSF. This is what I have set in DirectAdmin: But as I talked with DirectAdmin support team, when CSF is installed on the server, these settings don't ...
0
votes
1answer
82 views

Ubuntu 10.04LTS Server under attack, random reboots UNTIL I blocked China

What could have been sent to my server to cause it to reboot? Details: I have a for-internal-use LAMP server running Ubuntu 10.04LTS (upgrade is scheduled for that nebulous "when I have time"). It ...
1
vote
1answer
455 views

How to Blacklist a Range of IPs in cPHulk Brute Force Attack Settings

Does anyone know how to define a range of IPs to blacklist in the cPHulk Brute Force attack settings? I am getting bombarded from IPS 103.26.193.* and 103.26.194.* I Googled it and cannot find ...
1
vote
2answers
120 views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
3
votes
2answers
2k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
0
votes
1answer
364 views

Do cPHulk Brute Force Protection Settings Effect Hosts?

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
1
vote
1answer
357 views

Apache Error log showing File webdav,wp-login.php does not exist- Possible Attack

Apache Error Log shows the following messages. Seems like an attack to me But not sure what it means. Can anyone tell me what are these attacks and how to prevent any damage from such attacks [Wed ...
1
vote
1answer
87 views

How to I reset the false attempt login counter of iptable after a successful login?

I added the following firewall rules in order to defend against ssh attacks. iptables -N LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7 iptables -A LOGNDROP -j DROP ...
1
vote
3answers
144 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
1
vote
0answers
17 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
0
votes
1answer
106 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
0
votes
0answers
237 views

Postfix/SMTPD brute force attack - what is it doing?

For over 24 hours now, my CentOS6 server has been bombarded with the following connections. There are thousands of these log entries. I have set up Fail2ban and this has now banned over 10000 IPs and ...
2
votes
2answers
177 views

Multiple IP Brute Force Login Attack CentOS 6

Currently, one of my websites is being subject to a brute force login attempt. The problem is that it is coming form multiple IP sources. I have a system that auto bans IP after 3 attempts and so ...
1
vote
1answer
216 views

TS_Block and Windows 2008

I am running a Windows 2008 Server and I have installed ts_block on it to help block RDP brute force attempts on the server. Question 1: What I wanted to know is there any benefit for me using ...
0
votes
1answer
80 views

Brute Force Attacks - What Else Can I Do?

I am running a Windows 2008 Server which is racked in a data center. Over the last week I have noticed a lot of attempts to brute force login to the box via RDP. Here is what I have in place: Win ...
1
vote
3answers
188 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
3
votes
5answers
356 views

Is it typical to get brute force attack attempts on a brand new server?

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
0
votes
1answer
87 views

Preventing logon type 2 and 3 attacks on VPS

Sorry if this was asked before, but I've looked at other questions and couldn't find a match. I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). ...
0
votes
0answers
246 views

postfix attack using unknown command

I'm not exactly sure how to ask this question, but my postfix mail server endured some form of an attack Sunday morning. Every 3 seconds for about 5 minutes someone connected and ran 1 command, all ...
2
votes
4answers
463 views

Is this a 'port scan'?

Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...
1
vote
0answers
100 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
0
votes
1answer
201 views

SSHGuard - Configure netfilter/iptables

I have a question about the setting up/modus operandi of SSHGuard. I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login ...
0
votes
2answers
93 views

Dealing with brute force on RHEL

Box got slow and decided to vim /var/log/secure and saw a bunch of brute force methods trying to ssh with names starting from A-Z. iptables was installed so I added the ip via: iptables -I FORWARD ...
0
votes
2answers
165 views

how to identify & respond to bruteforce attacks

(skip to the end for less context) I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get ...
-1
votes
1answer
123 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
2
votes
1answer
296 views

ldap prevent brute force

The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks. It would be fine to prevent password guessing by locking a password for ...
1
vote
1answer
400 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
0
votes
1answer
130 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
3answers
182 views

How to stop failed login attempts by a domain

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
3
votes
1answer
136 views

Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?

Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...
1
vote
1answer
241 views

What's the right way to block brute force of HTTP basic auth?

Here's my thought, Set a threshold like 30 times in a minute, then block this IP for a few minutes. But If the attacker forge the source IP address, this could block legitimate user immediately. ...
2
votes
2answers
406 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
7
votes
3answers
430 views

Prevent SSH attacks

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing ...
1
vote
1answer
504 views

Suspected brute force attack [closed]

Recently I acquired a dedicated server from a local ISP to play around with. As the tags suggest, its a windows server 2008 R2 machine. I've only had it for a few days, and no real traffic is going ...
0
votes
1answer
394 views

Is there any conflict between DirectAdmin Brute force monitor and LFD?

Is there any conflict between DirectAdmin Brute force monitor and LFD? any help appreciated.
-1
votes
1answer
443 views

Why can't I add two '…-m recent --update --hitcount…' rules to iptables chain?

To stop brute force attacks on my server (OS is CentOS 6) I want to block for 1 minute everyone who makes more than 4 login attempts during last minute block for 1 day everyone who makes more than ...
0
votes
2answers
208 views

What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]

I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
0
votes
1answer
98 views

Virtualbox crash is that mean my server got attack?

I'm kind of confused right now recently my friend who also take care of the server got an email from the DirectAdmin say that we got Brute-Attack with one of the IP from Italy, but I didn't get a ...