0
votes
1answer
24 views

Deal with brute force ftp attack [duplicate]

While Checking the /var/log/secure on my centos server have found lot of attempts of failed login by using unknown usernames, from a list of ip from Japan And China How to hide my server from these ...
0
votes
2answers
71 views

SSH attacks on Freenas [closed]

I had my freenas box set up using no-ip to forward ssh requests to my machine so that I could get to it from work, friends house, parents, etc. A couple days ago i noticed a large in crease in ...
2
votes
1answer
336 views

How to stop/prevent SSH bruteforce

I'm very new to network administration, so please regard that I'm not that experienced yet. I have a Ubuntu root server with plesk panel. Yesterday my friends and I noticed that the quality of ...
1
vote
1answer
99 views

How to I reset the false attempt login counter of iptable after a successful login?

I added the following firewall rules in order to defend against ssh attacks. iptables -N LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7 iptables -A LOGNDROP -j DROP ...
0
votes
1answer
227 views

SSHGuard - Configure netfilter/iptables

I have a question about the setting up/modus operandi of SSHGuard. I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login ...
1
vote
1answer
445 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
0
votes
3answers
195 views

How to stop failed login attempts by a domain

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
7
votes
3answers
447 views

Prevent SSH attacks

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing ...
-1
votes
1answer
469 views

Why can't I add two '…-m recent --update --hitcount…' rules to iptables chain?

To stop brute force attacks on my server (OS is CentOS 6) I want to block for 1 minute everyone who makes more than 4 login attempts during last minute block for 1 day everyone who makes more than ...
0
votes
3answers
886 views

SSH Brute Force Attack; Auto-Ban IP-Addresses [duplicate]

Possible Duplicate: Preventing brute force attacks against ssh? We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH ...
1
vote
1answer
160 views

Troubleshooting potential compromised server from Brute Force SSH Attack [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY So I noticed some files/folders on my webserver and investigating leads the fact that a brute force attack via SSH was done on my ...
1
vote
1answer
598 views

Does enabling cPHulk from within WHM protect my entire server?

So I have enabled cPHulk on my web server, and just realized now that somebody (most likely a bot) is attempting to brute force their way into my WHM, thus leaving me out as well. I was shown this ...
6
votes
4answers
751 views

SSH public key authentication — always require users to generate their own keypair?

I was working with a partner today that I needed to upload files to my server using scp. I have passwords turned off in the server's SSH configuration, so I wanted them to use public key ...
1
vote
2answers
558 views

Preventing brute force attacks against ssh - on Windows Server?

Same question as this Preventing brute force attacks against ssh? - specifically for Windows Server. Strong passwords, RSA auth, and port knocking all apply to windows - but I'm hoping for something ...
8
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
3
votes
3answers
1k views

Most common account names used in ssh brute force attacks

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh? For your amusement, from my main server's logs over the last month (43 313 failed ...
4
votes
5answers
244 views

Grokking sophisticated dictionary attack

It appears that one of my servers is undergoing a sophisticated dictionary attack on ssh, in that I am seeing a bunch of usernames being tried on on of my servers alphabetically with password ...
1
vote
8answers
2k views

How to secure a Mac Server (“Possible break-in attempt” in logs)

I'm getting these quite frequently in my /var/log/secure.log: Nov 5 10:50:49 www sshd[775]: reverse mapping checking getaddrinfo for 124.107.32.54.pldt.net [124.107.32.54] failed - POSSIBLE BREAK-IN ...
3
votes
11answers
846 views

Ubuntu Server SSH

I have a server with ubuntu. I do work on it over SSH. I had a problem with brute force attempts over port 22. I changed the port and I assumed it fixed the brute force problem. Am I right or are the ...
38
votes
15answers
4k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...