3
votes
1answer
65 views

Ban IP Address on unsuccessful login on Server 2003

I'm regularly under brute force attacks on my Windows Server 2003 with Citrix installed. How can I automatically ban IP addresses that have several unsuccessful login attempts ? This question has ...
1
vote
2answers
120 views

What is the difference between /etc/hosts.allow and denyhosts' /var/lib/denyhosts/allowed-hosts?

Put another way, why doesn't denyhosts simply reference /etc/hosts.allow? Why does it have it's own file? Some of the denyhosts tutorials you see instruct the user to add their management IPs to this ...
1
vote
3answers
188 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
2
votes
4answers
463 views

Is this a 'port scan'?

Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...
0
votes
2answers
165 views

how to identify & respond to bruteforce attacks

(skip to the end for less context) I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get ...
1
vote
1answer
400 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
3
votes
1answer
136 views

Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?

Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...
2
votes
2answers
406 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
0
votes
2answers
208 views

What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]

I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
6
votes
3answers
3k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
3
votes
1answer
362 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
1
vote
1answer
381 views

Preventing Sendmail Brute Force Attack on Solaris 10

I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit ...
3
votes
4answers
368 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
4
votes
4answers
7k views

How to thwart PHPMyAdmin attacks?

We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
1
vote
2answers
546 views

Preventing brute force attacks against ssh - on Windows Server?

Same question as this Preventing brute force attacks against ssh? - specifically for Windows Server. Strong passwords, RSA auth, and port knocking all apply to windows - but I'm hoping for something ...
8
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
1
vote
3answers
946 views

I am getting brute forced, what do I do

I am getting brute forced to my email server, IMAP and POP3. I have the full package of ASL installed but it just sends me the OSSEC logs. How can I ban the IP. I thought ASL automatically blocked ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
8
votes
8answers
420 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
4
votes
5answers
242 views

Grokking sophisticated dictionary attack

It appears that one of my servers is undergoing a sophisticated dictionary attack on ssh, in that I am seeing a bunch of usernames being tried on on of my servers alphabetically with password ...
4
votes
3answers
7k views

Prevent brute force attacks in Microsoft FTP Server (IIS6/7)

Looking over my ftp-server logfiles, I find a lot of brute force attacks, where the same IP-address tries 100s of username/password combinations. Is there something I can do to make life harder on ...
13
votes
11answers
815 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
38
votes
15answers
4k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...