The tag has no usage guidance.

learn more… | top users | synonyms

7
votes
3answers
35k views

What is the source of thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext)?

I have a Windows Server 2008 R2 system that's showing thousands of 4625 Logon Failure errors with Logon Type 8 (NetworkCleartext) in the Security section of the Windows Logs every single day. There ...
0
votes
1answer
2k views

Do cPHulk Brute Force Protection Settings Effect Hosts? [closed]

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
1
vote
1answer
563 views

Apache Error log showing File webdav,wp-login.php does not exist- Possible Attack

Apache Error Log shows the following messages. Seems like an attack to me But not sure what it means. Can anyone tell me what are these attacks and how to prevent any damage from such attacks [Wed ...
1
vote
1answer
225 views

How to I reset the false attempt login counter of iptable after a successful login?

I added the following firewall rules in order to defend against ssh attacks. iptables -N LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "SSH attack! " --log-level 7 iptables -A LOGNDROP -j DROP ...
3
votes
3answers
781 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
0
votes
0answers
23 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
0
votes
1answer
318 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
2
votes
2answers
589 views

Multiple IP Brute Force Login Attack CentOS 6

Currently, one of my websites is being subject to a brute force login attempt. The problem is that it is coming form multiple IP sources. I have a system that auto bans IP after 3 attempts and so ...
1
vote
1answer
601 views

TS_Block and Windows 2008

I am running a Windows 2008 Server and I have installed ts_block on it to help block RDP brute force attempts on the server. Question 1: What I wanted to know is there any benefit for me using ...
0
votes
1answer
92 views

Brute Force Attacks - What Else Can I Do?

I am running a Windows 2008 Server which is racked in a data center. Over the last week I have noticed a lot of attempts to brute force login to the box via RDP. Here is what I have in place: Win ...
1
vote
3answers
443 views

Prevent server unusable on wordpress bruteforce attacks

I admin a server with lots of wordpress installations on it. Searching a solution to prevent high CPU on bruteforce attacks, this make the server unusable some hours a day. These are the targets: ...
3
votes
5answers
636 views

Is it typical to get brute force attack attempts on a brand new server?

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
0
votes
1answer
363 views

Preventing logon type 2 and 3 attacks on VPS

Sorry if this was asked before, but I've looked at other questions and couldn't find a match. I've been getting a lot of Logon Type 2 and 3 attacks on my Win Server 2008 VPS (from different IPs). I'...
2
votes
4answers
474 views

Is this a 'port scan'?

Is it still considered a 'port scan' to have scripts trying to SSH in with a list of common account names or trying multiple passwords for 'root' or 'mail' (or similar)? I'm hoping to find a way to ...
1
vote
0answers
148 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:...
0
votes
1answer
448 views

SSHGuard - Configure netfilter/iptables

I have a question about the setting up/modus operandi of SSHGuard. I would like to block ssh brute force attacks that happens about 3 times every second. I am on an Amazon instance, password login ...
0
votes
2answers
113 views

Dealing with brute force on RHEL

Box got slow and decided to vim /var/log/secure and saw a bunch of brute force methods trying to ssh with names starting from A-Z. iptables was installed so I added the ip via: iptables -I FORWARD -...
0
votes
2answers
855 views

how to identify & respond to bruteforce attacks

(skip to the end for less context) I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get ...
-1
votes
1answer
171 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
2
votes
1answer
919 views

ldap prevent brute force

The title should be self explanatory but more in detail I'm looking for a way to protect the ldap from LAN brute force attacks. It would be fine to prevent password guessing by locking a password for ...
1
vote
1answer
948 views

How should I manually add IP addresses to denyhosts?

I have a few IP addresses I want to add manually to denyhosts because they're huge sources of inbound spam. What's the best way to do this? Or should I not be messing with it? I want to manually ...
0
votes
1answer
211 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
3answers
333 views

How to stop failed login attempts by a domain

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
3
votes
1answer
152 views

Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?

Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...
1
vote
1answer
495 views

What's the right way to block brute force of HTTP basic auth?

Here's my thought, Set a threshold like 30 times in a minute, then block this IP for a few minutes. But If the attacker forge the source IP address, this could block legitimate user immediately. ...
2
votes
3answers
743 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
7
votes
3answers
567 views

Prevent SSH attacks

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing ...
1
vote
1answer
671 views

Suspected brute force attack [closed]

Recently I acquired a dedicated server from a local ISP to play around with. As the tags suggest, its a windows server 2008 R2 machine. I've only had it for a few days, and no real traffic is going ...
0
votes
1answer
570 views

Is there any conflict between DirectAdmin Brute force monitor and LFD? [closed]

Is there any conflict between DirectAdmin Brute force monitor and LFD? any help appreciated.
-1
votes
2answers
762 views

Why can't I add two '…-m recent --update --hitcount…' rules to iptables chain?

To stop brute force attacks on my server (OS is CentOS 6) I want to block for 1 minute everyone who makes more than 4 login attempts during last minute block for 1 day everyone who makes more than ...
0
votes
2answers
351 views

What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]

I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
0
votes
1answer
106 views

Virtualbox crash is that mean my server got attack? [closed]

I'm kind of confused right now recently my friend who also take care of the server got an email from the DirectAdmin say that we got Brute-Attack with one of the IP from Italy, but I didn't get a ...
-1
votes
2answers
242 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
-1
votes
1answer
597 views

Is cpHulk known to exhaust system resources, to the point of oom-killer getting called? [closed]

This issue started happening a week after I got a server upgrade, from iWeb. The new IPs that were assigned to me, were on some massive hacker/botnet list; so, for the first while I was getting insane ...
2
votes
3answers
1k views

How to protect ejabberd from bruteforce attacks?

It writes this in logs: =INFO REPORT==== 2012-03-14 17:48:54 === I(<0.467.0>:ejabberd_listener:281) : (#Port<0.4384>) Accepted connection {{10,254,239,2},51986} -> {{10,254,239,1},5222}...
15
votes
3answers
9k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
3answers
2k views

SSH Brute Force Attack; Auto-Ban IP-Addresses [duplicate]

Possible Duplicate: Preventing brute force attacks against ssh? We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH port ...
1
vote
1answer
235 views

Which password entropy for MS-CHAPv2

I am looking at connecting in a reasonably secured way mobiles to an enterprise WiFi network. The current solutions would be user certificates on the mobiles (they are unfortunately exportable) or ...
-5
votes
1answer
514 views

Wich module to defend my apache server? [closed]

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
1
vote
1answer
204 views

Troubleshooting potential compromised server from Brute Force SSH Attack [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY So I noticed some files/folders on my webserver and investigating leads the fact that a brute force attack via SSH was done on my ...
1
vote
1answer
834 views

Does enabling cPHulk from within WHM protect my entire server? [closed]

So I have enabled cPHulk on my web server, and just realized now that somebody (most likely a bot) is attempting to brute force their way into my WHM, thus leaving me out as well. I was shown this ...
0
votes
1answer
3k views

Block brute force attack via Remote Desktop Protocol [duplicate]

Possible Duplicate: Ban, slowdown or stop massive login attempts to RDP I have a Windows 2008 Server which is being attacked very hard. Somebody is trying to use brute force to sign in to the ...
0
votes
2answers
952 views

How to use RegEx for mod_security

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1 /website1/login.php /website2/login.php /website3/login.php /websiteN/login.php ...
3
votes
1answer
443 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
3
votes
2answers
750 views

Fighting Off Network Flooding

my website sometimes gets attacked by people. You can see such an attack at 18:00 and later on a bigger attack at 22:30. Basicly the servers network card gets flooded by incoming requests. My ...
2
votes
3answers
4k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
4
votes
5answers
2k views

What should I do if I find someone is brute forcing my server password?

I just checked the eventlog on my vps and found that someone is brute forcing both my sql server sa password and windows administrator password. (I have changed the account name from Administrator to ...
3
votes
3answers
2k views

Win2008R2 :Brute force attack prevention

I am using Windows 2008 R2. I am wondering if there is any way to block a brute force attack. I seeked here and there and I could not find a way to block an IP address after its makes some failing ...
1
vote
3answers
2k views

Attempt to access SQL Server with the user SA

I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins 3 attempts in SQL Server? Moreover, I would like to block an IP, how can I ...