The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
151 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
0
votes
3answers
223 views

How to stop failed login attempts by a domain

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use ...
3
votes
1answer
142 views

Apache / Ubuntu 9.04: How do I counter-threats and improve the security of my server environment?

Our server hosts over a thousand sites, and some of them seem to have been hijacked by malicious scripts. These scripts run actions normally performed by a legitimate user en masse, causing severe ...
1
vote
1answer
295 views

What's the right way to block brute force of HTTP basic auth?

Here's my thought, Set a threshold like 30 times in a minute, then block this IP for a few minutes. But If the attacker forge the source IP address, this could block legitimate user immediately. ...
2
votes
2answers
477 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
7
votes
3answers
466 views

Prevent SSH attacks

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing ...
1
vote
1answer
548 views

Suspected brute force attack [closed]

Recently I acquired a dedicated server from a local ISP to play around with. As the tags suggest, its a windows server 2008 R2 machine. I've only had it for a few days, and no real traffic is going ...
0
votes
1answer
444 views

Is there any conflict between DirectAdmin Brute force monitor and LFD?

Is there any conflict between DirectAdmin Brute force monitor and LFD? any help appreciated.
-1
votes
2answers
529 views

Why can't I add two '…-m recent --update --hitcount…' rules to iptables chain?

To stop brute force attacks on my server (OS is CentOS 6) I want to block for 1 minute everyone who makes more than 4 login attempts during last minute block for 1 day everyone who makes more than ...
0
votes
2answers
241 views

What is the best alternative to BFD? Somethings to block DDoS and Brute Force Attacks? [closed]

I have an Ubuntu server which is running Nginx and have a Wordpress site. I need good protection for it. Recently I found that BFD is causing some problems so I had to disable it. Does any one know ...
0
votes
1answer
98 views

Virtualbox crash is that mean my server got attack?

I'm kind of confused right now recently my friend who also take care of the server got an email from the DirectAdmin say that we got Brute-Attack with one of the IP from Italy, but I didn't get a ...
-1
votes
2answers
186 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
-1
votes
1answer
394 views

Is cpHulk known to exhaust system resources, to the point of oom-killer getting called?

This issue started happening a week after I got a server upgrade, from iWeb. The new IPs that were assigned to me, were on some massive hacker/botnet list; so, for the first while I was getting insane ...
2
votes
3answers
961 views

How to protect ejabberd from bruteforce attacks?

It writes this in logs: =INFO REPORT==== 2012-03-14 17:48:54 === I(<0.467.0>:ejabberd_listener:281) : (#Port<0.4384>) Accepted connection {{10,254,239,2},51986} -> ...
7
votes
3answers
4k views

Rate limiting with UFW: setting limits

UFW's man page mentions that it can setup iptables rate limiting for me: ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
0
votes
3answers
1k views

SSH Brute Force Attack; Auto-Ban IP-Addresses [duplicate]

Possible Duplicate: Preventing brute force attacks against ssh? We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH ...
1
vote
1answer
189 views

Which password entropy for MS-CHAPv2

I am looking at connecting in a reasonably secured way mobiles to an enterprise WiFi network. The current solutions would be user certificates on the mobiles (they are unfortunately exportable) or ...
-4
votes
1answer
338 views

Wich module to defend my apache server?

Well I find this 3 apache modules (mod_evasive, mod_qos, mod_security) but I want to know wich is better to defend my server from a Denial-of-service attack? Server version: Apache/2.2.17 (Win32) ...
1
vote
1answer
170 views

Troubleshooting potential compromised server from Brute Force SSH Attack [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY So I noticed some files/folders on my webserver and investigating leads the fact that a brute force attack via SSH was done on my ...
1
vote
1answer
649 views

Does enabling cPHulk from within WHM protect my entire server?

So I have enabled cPHulk on my web server, and just realized now that somebody (most likely a bot) is attempting to brute force their way into my WHM, thus leaving me out as well. I was shown this ...
0
votes
1answer
3k views

Block brute force attack via Remote Desktop Protocol [duplicate]

Possible Duplicate: Ban, slowdown or stop massive login attempts to RDP I have a Windows 2008 Server which is being attacked very hard. Somebody is trying to use brute force to sign in to ...
0
votes
2answers
520 views

How to use RegEx for mod_security

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1 /website1/login.php /website2/login.php /website3/login.php /websiteN/login.php ...
3
votes
1answer
382 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
3
votes
2answers
599 views

Fighting Off Network Flooding

my website sometimes gets attacked by people. You can see such an attack at 18:00 and later on a bigger attack at 22:30. Basicly the servers network card gets flooded by incoming requests. My ...
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
4
votes
5answers
1k views

What should I do if I find someone is brute forcing my server password?

I just checked the eventlog on my vps and found that someone is brute forcing both my sql server sa password and windows administrator password. (I have changed the account name from Administrator to ...
3
votes
3answers
1k views

Win2008R2 :Brute force attack prevention

I am using Windows 2008 R2. I am wondering if there is any way to block a brute force attack. I seeked here and there and I could not find a way to block an IP address after its makes some failing ...
1
vote
3answers
1k views

Attempt to access SQL Server with the user SA

I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins 3 attempts in SQL Server? Moreover, I would like to block an IP, how can I ...
4
votes
1answer
146 views

Attempt to access SQL Server with the user SA [duplicate]

Possible Duplicate: Attempt to access SQL Server with the user SA I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins ...
1
vote
1answer
413 views

Preventing Sendmail Brute Force Attack on Solaris 10

I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit ...
3
votes
4answers
381 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
3
votes
1answer
2k views

How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?

How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
1
vote
3answers
411 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
32
votes
10answers
26k views

Ban IP address based on X number of unsuccessful login attempts?

Is it possible to ban an IP address after X number of unsuccessful login attempts to a Windows Server? Not to a particular account, which I know how to do, but to the whole machine. We get hit pretty ...
11
votes
5answers
23k views

How to stop brute force attacks on Terminal Server (Win2008R2)?

I'm more familiar with Linux tools to stop brute force attacks, so I'm having trouble finding suitable tools for Windows. I'm running a Windows Server 2008 R2 with Terminal Server, and I'd like to ...
4
votes
2answers
3k views

How to secure Outlook Web Access against Brute Force attack?

I'd like to secure Outlook Web Access with Exchange 2010 against a brute force attack using account lockout. What is the best way to do this? I have the following group policy: Computer ...
6
votes
4answers
766 views

SSH public key authentication — always require users to generate their own keypair?

I was working with a partner today that I needed to upload files to my server using scp. I have passwords turned off in the server's SSH configuration, so I wanted them to use public key ...
4
votes
4answers
8k views

How to thwart PHPMyAdmin attacks?

We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
2
votes
3answers
2k views

Can I Use iptables rate limiting to temporarily block FTP server brute-force attempts?

This is along a similar line to other posts on brute-force attacks, but a bit more specific: We are able to enforce decent passwords, generally, and user name policy also avoids falling prey to what ...
1
vote
2answers
602 views

Preventing brute force attacks against ssh - on Windows Server?

Same question as this Preventing brute force attacks against ssh? - specifically for Windows Server. Strong passwords, RSA auth, and port knocking all apply to windows - but I'm hoping for something ...
9
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
0
votes
3answers
453 views

Auto-ban IP from connecting to SQL Server 2005 after n failed logons?

I'm helping a customer with an exposed SQL Server 2005. They will not budge on a firewall or VPN solution, and their logs are full of signs of a brute force attack. Is there way to auto-ban an IP ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
1
vote
3answers
989 views

I am getting brute forced, what do I do

I am getting brute forced to my email server, IMAP and POP3. I have the full package of ASL installed but it just sends me the OSSEC logs. How can I ban the IP. I thought ASL automatically blocked ...
3
votes
3answers
1k views

Most common account names used in ssh brute force attacks

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh? For your amusement, from my main server's logs over the last month (43 313 failed ...
27
votes
7answers
22k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
3
votes
4answers
1k views

Server attack monitor

We've been getting some attacks on our server I think, because our server gets down every day now. I want to monitor what is causing the server to go down or if there is any attack from some site or ...
8
votes
8answers
422 views

Servers harrassed by individual on constantly changing IPs

We run a community product. There is an individual (a little PoS kid) in the UK that is harassing our site for the last 6 months. His daily task is to create a new account, post a bunch of illegal / ...