The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
2answers
169 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
-1
votes
1answer
327 views

Is cpHulk known to exhaust system resources, to the point of oom-killer getting called?

This issue started happening a week after I got a server upgrade, from iWeb. The new IPs that were assigned to me, were on some massive hacker/botnet list; so, for the first while I was getting insane ...
2
votes
3answers
745 views

How to protect ejabberd from bruteforce attacks?

It writes this in logs: =INFO REPORT==== 2012-03-14 17:48:54 === I(<0.467.0>:ejabberd_listener:281) : (#Port<0.4384>) Accepted connection {{10,254,239,2},51986} -> ...
6
votes
3answers
3k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
3answers
830 views

SSH Brute Force Attack; Auto-Ban IP-Addresses [duplicate]

Possible Duplicate: Preventing brute force attacks against ssh? We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH ...
1
vote
1answer
164 views

Which password entropy for MS-CHAPv2

I am looking at connecting in a reasonably secured way mobiles to an enterprise WiFi network. The current solutions would be user certificates on the mobiles (they are unfortunately exportable) or ...
-4
votes
1answer
284 views

Wich module to defend my apache server?

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
1
vote
1answer
156 views

Troubleshooting potential compromised server from Brute Force SSH Attack [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY So I noticed some files/folders on my webserver and investigating leads the fact that a brute force attack via SSH was done on my ...
1
vote
1answer
583 views

Does enabling cPHulk from within WHM protect my entire server?

So I have enabled cPHulk on my web server, and just realized now that somebody (most likely a bot) is attempting to brute force their way into my WHM, thus leaving me out as well. I was shown this ...
0
votes
1answer
3k views

Block brute force attack via Remote Desktop Protocol [duplicate]

Possible Duplicate: Ban, slowdown or stop massive login attempts to RDP I have a Windows 2008 Server which is being attacked very hard. Somebody is trying to use brute force to sign in to ...
0
votes
2answers
443 views

How to use RegEx for mod_security

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1 /website1/login.php /website2/login.php /website3/login.php /websiteN/login.php ...
3
votes
1answer
362 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
3
votes
2answers
561 views

Fighting Off Network Flooding

my website sometimes gets attacked by people. You can see such an attack at 18:00 and later on a bigger attack at 22:30. Basicly the servers network card gets flooded by incoming requests. My ...
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
4
votes
5answers
1k views

What should I do if I find someone is brute forcing my server password?

I just checked the eventlog on my vps and found that someone is brute forcing both my sql server sa password and windows administrator password. (I have changed the account name from Administrator to ...
3
votes
3answers
1k views

Win2008R2 :Brute force attack prevention

I am using Windows 2008 R2. I am wondering if there is any way to block a brute force attack. I seeked here and there and I could not find a way to block an IP address after its makes some failing ...
1
vote
3answers
1k views

Attempt to access SQL Server with the user SA

I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins 3 attempts in SQL Server? Moreover, I would like to block an IP, how can I ...
4
votes
1answer
143 views

Attempt to access SQL Server with the user SA [duplicate]

Possible Duplicate: Attempt to access SQL Server with the user SA I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins ...
1
vote
1answer
381 views

Preventing Sendmail Brute Force Attack on Solaris 10

I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit ...
3
votes
4answers
368 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
3
votes
1answer
2k views

How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?

How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
1
vote
3answers
366 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
29
votes
10answers
23k views

Ban IP address based on X number of unsuccessful login attempts?

Is it possible to ban an IP address after X number of unsuccessful login attempts to a Windows Server? Not to a particular account, which I know how to do, but to the whole machine. We get hit pretty ...
10
votes
5answers
19k views

How to stop brute force attacks on Terminal Server (Win2008R2)?

I'm more familiar with Linux tools to stop brute force attacks, so I'm having trouble finding suitable tools for Windows. I'm running a Windows Server 2008 R2 with Terminal Server, and I'd like to ...
4
votes
2answers
3k views

How to secure Outlook Web Access against Brute Force attack?

I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout. What is the best way to do this? I have the following group policy: Computer ...
6
votes
4answers
739 views

SSH public key authentication — always require users to generate their own keypair?

I was working with a partner today that I needed to upload files to my server using scp. I have passwords turned off in the server's SSH configuration, so I wanted them to use public key ...
4
votes
4answers
7k views

How to thwart PHPMyAdmin attacks?

We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
2
votes
3answers
2k views

Can I Use iptables rate limiting to temporarily block FTP server brute-force attempts?

This is along a similar line to other posts on brute-force attacks, but a bit more specific: We are able to enforce decent passwords, generally, and user name policy also avoids falling prey to what ...
1
vote
2answers
544 views

Preventing brute force attacks against ssh - on Windows Server?

Same question as this Preventing brute force attacks against ssh? - specifically for Windows Server. Strong passwords, RSA auth, and port knocking all apply to windows - but I'm hoping for something ...
8
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
0
votes
3answers
423 views

Auto-ban IP from connecting to SQL Server 2005 after n failed logons?

I'm helping a customer with an exposed SQL Server 2005. They will not budge on a firewall or VPN solution, and their logs are full of signs of a brute force attack. Is there way to auto-ban an IP ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
1
vote
3answers
946 views

I am getting brute forced, what do I do

I am getting brute forced to my email server, IMAP and POP3. I have the full package of ASL installed but it just sends me the OSSEC logs. How can I ban the IP. I thought ASL automatically blocked ...
3
votes
3answers
1k views

Most common account names used in ssh brute force attacks

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh? For your amusement, from my main server's logs over the last month (43 313 failed ...
20
votes
6answers
17k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
3
votes
4answers
1k views

Server attack monitor

We've been getting some attacks on our server I think, because our server gets down every day now. I want to monitor what is causing the server to go down or if there is any attack from some site or ...
8
votes
8answers
420 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...
1
vote
1answer
2k views

How secure is encfs

Like others on this site, I am considering using encfs + sshfs for secure offsite backups. I am wondering how robust encfs is to brute force attacks? Do some users use the --stdinpass command with a ...
0
votes
3answers
806 views

How long should I make my SSL cert valid for?

* sgsax hates ssl certs < Landon> indeed < Landon> next time my servers cert expires I'm just going to make one for 100 years or something ridiculously long Is there ...
4
votes
5answers
242 views

Grokking sophisticated dictionary attack

It appears that one of my servers is undergoing a sophisticated dictionary attack on ssh, in that I am seeing a bunch of usernames being tried on on of my servers alphabetically with password ...
0
votes
3answers
374 views

PREVENT SQL SERVER 2005 ATTACK

I have an sql server 2005 instance running in default 1433 port. I am getting too many invalid logins from different ip address, may be some hacking programs trying to attack, i am running windows ...
1
vote
8answers
2k views

How to secure a Mac Server (“Possible break-in attempt” in logs)

I'm getting these quite frequently in my /var/log/secure.log: Nov 5 10:50:49 www sshd[775]: reverse mapping checking getaddrinfo for 124.107.32.54.pldt.net [124.107.32.54] failed - POSSIBLE BREAK-IN ...
7
votes
7answers
1k views

Preventing brute-force attacks on MySQL?

I need to turn on networking for MySQLd, but every time I do, the server gets brute-forced into oblivion. Some mean password guessing script starts hammering on the server, opening a connection on ...
3
votes
11answers
845 views

Ubuntu Server SSH

I have a server with ubuntu. I do work on it over SSH. I had a problem with brute force attempts over port 22. I changed the port and I assumed it fixed the brute force problem. Am I right or are the ...
1
vote
4answers
192 views

rhel-5.3->vm wordpress attack

i have a rhel 5.3 w/ few virtual machines and one of virtual pc runs cpu: intel quad 2.83 mem: 3.5G os: Linux 2.6.18-128.1.14.el5xen #1 SMP Mon Jun 1 16:09:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux ...
8
votes
9answers
5k views

How secure are passwords with under 20 characters length?

I recently received a recommandation for setting my password to above 20 characters. The algorithm used for encryption is AES with a 256 bit primary key. How secure is a, let's say, 8 char password ...
4
votes
3answers
7k views

Prevent brute force attacks in Microsoft FTP Server (IIS6/7)

Looking over my ftp-server logfiles, I find a lot of brute force attacks, where the same IP-address tries 100s of username/password combinations. Is there something I can do to make life harder on ...
5
votes
7answers
5k views

Equivalent to denyhosts, but for HTTP requests?

My web server (apache2) is continually pounded by malicious bots, asking for URLs like these: ...