Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force-attacks]

The tag has no usage guidance.

0
votes
1answer
11 views

fail2ban filter matches no lines for xmlrpc attack

I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form [Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
0
votes
0answers
29 views

How to Ban WordPress Brute Force Attack by Client From Apache's Server Status Page?

I have a server hosting multiple domains and protected by Fail2Ban with WP Fail2Ban and wordpress-hard + wordpress-soft rules. Recently I notice that our server is heavily loaded and seems like we ...
0
votes
1answer
51 views

Blocking “pokes” of our system

We get tons of these in our apache error log every day. [Wed Oct 17 03:27:37 2018] [error] [client 103.41.124.159] File does not exist: /var/www/html/phpmyadmin [Wed Oct 17 03:27:37 2018] [error] [...
4
votes
4answers
2k views

How to secure servers from a cgi-bin/php POST request attack

We got a POST request to our server with the following in it: %63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%...
0
votes
1answer
57 views

Block outside TCP requests from centos server

I have a centOS server and user to host web systems with LAMP. Server owners are complaining that we are sending abnormal TCP requests to external server. How can we block these types of requests? ...
0
votes
1answer
63 views

Suspicion of brute force attack on mysql

In these last couple of days, one my vps server has crashed twice for no appearant reasons. All sytems on it are up to date. Fail2ban is installed and jailed as much as usual, I trust the server's ...
1
vote
1answer
227 views

RDP Server under attack; IP address used is our server address

I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses. ...
0
votes
1answer
71 views

My web server is being hit, all resources are maxed out, how to find out the root cause?

Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
1
vote
1answer
146 views

Stop HTTP Post Requests with NGINX Before Hitting WordPress Application Log-in Page

Since the bots send HTTP Post requests directly at the known target /wp-login.php to skip the Captcha, would it be possible to check for a custom Post Input such as the Captcha Input or my own custom ...
1
vote
1answer
186 views

NGINX Brute Force Detection of devices hiding behind NAT. Block only specific device and not all devices sharing the same IP

I have a AWS EC2 Ubuntu instance with NGINX server configured to listen on IP address 50.0.0.1 (Example) on port 80. I have a login page in index.php. I want to configure nginx for brute force ...
0
votes
2answers
177 views

A smart attack on SMTP evading fail2ban

I have an ongoing brute-force attack on my SMTP server in a way that evades typical fail2ban settings: attacks take place from several IPs in the same subnet a single IP attacks in intervals longer ...
0
votes
2answers
224 views

Windows and Apache Block IP by Country

I'm having DDoS attacks and brute force, my clients are only from a Latin American country and I did not find attacks from that country, so I think my solution would be to find a way to block ips from ...
1
vote
1answer
73 views

Brute Forcing IPs

I have random IPs constantly targetting my Apache server. A sample of what I get in my log: 80.108.96.31 - - [18/Aug/2017:16:16:08 +0000] "GET /machine.xml HTTP/1.1" 403 520 "-" "Mozilla/4.0 (...
0
votes
2answers
441 views

Automatic exim4 ban ip

I would like to know if it is possible to automatically ban/filter an IP for few time in case of multiple authentication failure in exim4 server.
0
votes
2answers
1k views

Brute force attack with no IP to trace

I am getting constant event 4625 messages saying that accounts are failing to log in with non-existent usernames. Names such as: SALES, USER, TEST, HELPDESK, SUPPORT, PROGRAMMER are not users of ours, ...
1
vote
1answer
714 views

Auto-ban IP from “wp-login.php” attackers

When I look at my Apache log other_vhosts_access.log, I see many many attempts, from a few different IP per month like this: www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:19 +0200] "POST /wp-...
0
votes
0answers
125 views

How to ban abusers who use my public SOCKS5 proxy server to brutforce 3-rd party sites?

We have been thinking for very long time about it. It's easy to escape abusers who use my server to send email spam by blocking email ports, but how to ban abusers who use my public SOCKS5 proxy ...
1
vote
2answers
4k views

Blocking IPs in HAProxy

A client's website is currently under attack, and I've been called in to fix it. A huge number of IPs (easily over 5,000) is constantly hitting /login, presumably trying to bruteforce their way in. ...
7
votes
3answers
3k views

Securing linux servers: iptables vs fail2ban

I would like to pick the community's brain regarding linux server security, specifically regarding brute-force attacks and using fail2ban vs custom iptables. There are a few similar questions out ...
0
votes
3answers
1k views

Using iptables to prevent SSH brute force attacks and DDOS attacks

I have the following lines at the very top of iptables, these are used to prevent SSH brute force attacks and DDOS attacks: iptables segment to prevent SSH brute force attacks and DDOS attacks What ...
1
vote
1answer
476 views

fail2ban with vsftpd explicit sftp

The fail2ban vsftpd default config doesn't take care of blocking brute force requests when tls is enabled on vsftpd. At the moment the vsftpd log only shows the below lines which don't match the regex....
0
votes
1answer
2k views

Too many TIME_WAIT connections on mysql from an outside host

My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...
2
votes
2answers
1k views

fail2ban reject brute force spam bots

Would it be wise if I modify postfix fail2ban rule from this: failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: ...
1
vote
2answers
322 views

Someone try to hack my server

I have a linux machine running as a test server. My box redirects my port like 80 directly on this machine. I created it to train all kind of things (raid, tcp...). Recently I tried to connect to my ...
1
vote
1answer
777 views

Someone posting to /wp-login.php every 2 minutes. Is it commonly happens?

When I check my nginx access.log there are requests (GET request followed by POST) every two minutes on /wp-login.php. Then I log those POST requests (changing login page to empty page and save POST ...
0
votes
0answers
57 views

is it possible to block proxy (or TOR) connection attempts on my server?

I have a website that gets about 2000 visitors/month, but I'm also getting about 500 break-in attempts per day. In auth.log every few minutes I get a 8 of these: Oct 19 16:34:14 main-srv vsftpd[7361]:...
3
votes
2answers
3k views

Get Fail2Ban To Check findtime Every X Minutes

I have fail2ban set up with the following settings: bantime = 86400 findtime = 600 maxretry = 2 This is great as it stops any IPs who are brute forcing 3 times within 10 minutes. However, there ...
1
vote
1answer
508 views

What Is Better For Security And Performance - APF or Fail2ban?

I have been doing plenty of research on Advanced Policy Firewall (APF) and Fail2Ban. I have a VPS under SSH brute force attack. I'm leaning towards APF and just allowing on my few IPs through. However,...
0
votes
1answer
417 views

Limit Wordpress login to certain ip-addresses on Nginx and PHP-FPM

I've seen a lot of bruce force attacks on Wordpress, so I want to limit access to wp-login.php. It's the latest Wordpress on a Ubuntu 16.04LTS Nginx server with PHP-FPM. I've tried the advice from ...
1
vote
1answer
220 views

How to protect saslauthd from local brute force attack?

There are numerous instructions over the internet to use saslauthd. I've tried to run the service. It gave me a surprise when I discovered that /run/saslauthd/mux socket and /usr/sbin/testsaslauthd ...
1
vote
1answer
116 views

Dealing with Brute Force Attack

For the better part of yesterday (and today so far) my server is being attacked with brute force. I am rather an inexperience admin when it gets passed the basics. I understand how to find things, ...
2
votes
2answers
142 views

Fail2ban regex doesn't match my log

I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it. My log lines looks like these: [Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [...
0
votes
1answer
57 views

Suspicious requests from same IP

I am checking my apache error log, and I see a weird pattern. Same IP requests, within 1 second, pages that are 'common' in websites: wp,wordpress,joomla.. etc. Because this specific domain doesn'...
-2
votes
2answers
359 views

Brute force ssh login attacks has slowed down my servers

Brute force ssh login attacks has slowed down my servers. I have already blocked ssh of foreign ips except mine internal network (iptables -A INPUT -p tcp --dport 22 -j DROP) but load has gone upto ...
0
votes
1answer
1k views

Stop and prevent brute force attacks on Ubuntu 14.04

I've currently 3 servers with SSH service being attacked by brute force. The attack is from multiple sources or one who's changing his IP with each attempt performed. I need help to stop current ...
-2
votes
3answers
802 views

Automatically block IPs which are making large number of requests to server in given time period

I have deployed WP project on a CentOS based Linux server. I am experiencing unusual traffic (crawling) from random IP addresses hence causing very high server load (as high as average load 200). Is ...
2
votes
1answer
553 views

Ubuntu Nginx after blocking ip address, still showing up in logs

I have a server that keeps trying to brute force hack via xml-rpc post on a wordpress site. I've blocked the ip address in nginx.conf and noticed that I kept getting these errors in the log file, and ...
1
vote
2answers
141 views

Is it possible to use iptables on Ubuntu to limit brute force attacks?

Is it possible to use iptables on Ubuntu to limit brute force attacks for certain URLs? Basically I want to detect where user calls same url over and over again and drop his connection or somehow slow ...
0
votes
0answers
23 views

Server exploited, bruteforcing ssh machines. Exploit keeps coming back [duplicate]

a customer server of ours has been compromised. He was running an centos 5.9 machine, with plesk 11.5 on it. The hack/exploit was located in /var/html/ with files like: gosh.sh and encoded files ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
-4
votes
2answers
292 views

Where do the Chinese, Russian and etc. random attackers find their targets?

I recently started running a personal site on a dedicated server that i've had for some time, but have never actually used. I have never checked it's logs, but now when i do, auth.log is full with ...
1
vote
1answer
297 views

What are the differences between Fail2Ban and BFD (Brute Force Detection)

I have used both Fail2Ban and BFD, typically I go with Fail2Ban on servers running IPTables, and BFD when servers are running APF. Are there any major differences between these 2 services? What are ...
0
votes
0answers
215 views

mod_evasive: Stop attacks against wp-login.php

i would like to stop attacks against some user's WordPress-installations on my server. This is an example of an attack: 91.208.65.12 - - [20/Oct/2015:10:33:08 +0200] "POST /wp-login.php HTTP/1.0" ...
-3
votes
1answer
391 views

ModSecurity error on wordpress wp-login rules [closed]

I have made i ModSecurity rule for apache to protect wordpress, but it have some error, so please suggest me some modification to work it fine. # This has to be global, cannot exist within a ...
1
vote
0answers
169 views

Strange URL requests via Nginx on Ubuntu 14.04, what is the malicious user trying to do?

A malicious user has been trying to browse to strange URLs that don't exist on my server. One such request turned out to be url encoding: %2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%...
3
votes
3answers
1k views

Remote users attempting to gain access to root mysqld

I have just reviewed my syslog file and notice a TON of entries of the following: Aug 25 13:06:17 ssrv001 mysqld: 150825 13:06:17 [Warning] Access denied for user 'root'@'61.160.232.48' (using ...
-1
votes
1answer
126 views

How can I defend against malicious GET requests? [duplicate]

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
5
votes
3answers
1k views

How can I combat all of these brute force attacks?

I have 3 dedicated servers, all running CentOS that are physically located in Canada. On the newest server, cPHulk started detecting (and blacklisting) failed login attempts. It started the day that ...
0
votes
1answer
100 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
5
votes
1answer
2k views

Outgoing brute force attacks from my server

One of the servers I look after appears to be participating in brute force attacks against Wordpress installations. I've been on the receiving end of this many times, so am very familiar with steps ...