Looking for module which will put ProFTPD brute-forcing ip address into hosts.deny. Say if 3 times password was incorrect, ban it from server, preventing to try other services.
4 Answers
If your not adverse to installing other tools than you could use something like Fail2Ban
Have a look at http://www.proftpd.org/docs/contrib/mod_ban.html
MaxLoginAttempts 1
<IfModule mod_ban.c>
BanEngine on
BanLog /var/log/proftpd/ban.log
BanTable /var/data//proftpd/ban.tab
# If the same client reaches the MaxLoginAttempts limit 2 times
# within 10 minutes, automatically add a ban for that client that
# will expire after one hour.
BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00
# Allow the FTP admin to manually add/remove bans
BanControlsACLs all allow user ftpadm
</IfModule>
-
This will not block ip address from connection, hence there is a risk that attacker will try brute-force another services. That's why I was looking for some way to block his ip from connecting to server at all.– MichaelMar 16, 2011 at 16:34
-
1Sorry I misread your querstion. Have a look at kevin.vanzonneveld.net/techblog/article/… and thebuzzmedia.com/using-fail2ban-to-prevent-brute-force-attacks Mar 16, 2011 at 16:41
iptables
can do this without the need to install any additional software, or reconfigure underlying services.
-
iptables doesn't checks for wrong logins on logs. fail2ban it's a service which checks logs and if it detects several wrong logins it will apply an iptables rule to lock that IP away. Jun 26, 2023 at 12:06
You can also try BFD which works with both APF and CSF.
See this for an example scenario.