0

Looking for module which will put ProFTPD brute-forcing ip address into hosts.deny. Say if 3 times password was incorrect, ban it from server, preventing to try other services.

1
  • I suggest you look at doing this at the firewall level for any service, rather than just for FTP. Mar 16, 2011 at 19:09

4 Answers 4

7

If your not adverse to installing other tools than you could use something like Fail2Ban

3

Have a look at http://www.proftpd.org/docs/contrib/mod_ban.html

  MaxLoginAttempts 1

  <IfModule mod_ban.c>
    BanEngine on
    BanLog /var/log/proftpd/ban.log
    BanTable /var/data//proftpd/ban.tab

    # If the same client reaches the MaxLoginAttempts limit 2 times
    # within 10 minutes, automatically add a ban for that client that
    # will expire after one hour.
    BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00

    # Allow the FTP admin to manually add/remove bans
    BanControlsACLs all allow user ftpadm
  </IfModule>
2
0

iptables can do this without the need to install any additional software, or reconfigure underlying services.

1
  • iptables doesn't checks for wrong logins on logs. fail2ban it's a service which checks logs and if it detects several wrong logins it will apply an iptables rule to lock that IP away.
    – NetVicious
    Jun 26, 2023 at 12:06
0

You can also try BFD which works with both APF and CSF.

See this for an example scenario.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .