The tag has no wiki summary.

learn more… | top users | synonyms

38
votes
15answers
4k views

Preventing brute force attacks against ssh?

What tool or technique do you use to prevent brute force attacks against your ssh port. I noticed in my Security logs, that I have millions of attempts to login as various users through ssh. This is ...
10
votes
5answers
22k views

How to stop brute force attacks on Terminal Server (Win2008R2)?

I'm more familiar with Linux tools to stop brute force attacks, so I'm having trouble finding suitable tools for Windows. I'm running a Windows Server 2008 R2 with Terminal Server, and I'd like to ...
31
votes
10answers
26k views

Ban IP address based on X number of unsuccessful login attempts?

Is it possible to ban an IP address after X number of unsuccessful login attempts to a Windows Server? Not to a particular account, which I know how to do, but to the whole machine. We get hit pretty ...
9
votes
12answers
1k views

Securing SSH server against bruteforcing

I have a little SVN server, old dell optiplex running debian. I don't have that high demands on my server, because its just a little SVN server... but do want it to be secure. I just renewed my ...
4
votes
5answers
1k views

What should I do if I find someone is brute forcing my server password?

I just checked the eventlog on my vps and found that someone is brute forcing both my sql server sa password and windows administrator password. (I have changed the account name from Administrator to ...
1
vote
3answers
1k views

Attempt to access SQL Server with the user SA

I'm suffering an attempted invasion by brute force. A bot is trying to figure out the sa password. How do I restrict logins 3 attempts in SQL Server? Moreover, I would like to block an IP, how can I ...
1
vote
3answers
395 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
3
votes
11answers
852 views

Ubuntu Server SSH

I have a server with ubuntu. I do work on it over SSH. I had a problem with brute force attempts over port 22. I changed the port and I assumed it fixed the brute force problem. Am I right or are the ...
14
votes
11answers
851 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
6
votes
7answers
6k views

Equivalent to denyhosts, but for HTTP requests?

My web server (apache2) is continually pounded by malicious bots, asking for URLs like these: ...
4
votes
3answers
7k views

Prevent brute force attacks in Microsoft FTP Server (IIS6/7)

Looking over my ftp-server logfiles, I find a lot of brute force attacks, where the same IP-address tries 100s of username/password combinations. Is there something I can do to make life harder on ...
4
votes
4answers
8k views

How to thwart PHPMyAdmin attacks?

We see a lot of requests for non-existent setup.php files in our access logs (see below). For some of our clients that use rewrite rules each of these requests will cause a PHP script to be executed, ...
3
votes
5answers
401 views

Is it typical to get brute force attack attempts on a brand new server?

I recently migrated to a new host, a VPS solution. From day one, I started getting WHM/cPanel notifications of brute force attack attempts via root on the main account, 3-4 times per day. I know this ...
2
votes
1answer
1k views

How to Blacklist a Range of IPs in cPHulk Brute Force Attack Settings

Does anyone know how to define a range of IPs to blacklist in the cPHulk Brute Force attack settings? I am getting bombarded from IPS 103.26.193.* and 103.26.194.* I Googled it and cannot find ...
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
2
votes
11answers
1k views

Preventing brute force attacks

What are the best tools to prevent Brute force attacks against ssh and FTP on Linux servers ?
0
votes
1answer
883 views

Do cPHulk Brute Force Protection Settings Effect Hosts?

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...