Questions tagged [brute-force-attacks]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
133 views

Block bruteforce attempts with nginx & cloudflare without rate limiting

So I discovered servers trying to bruteforce my API so I want to block them...but my specific scenario made it difficult to work with common solutions found on the internet. 1) I don't want to just ...
0
votes
0answers
61 views

Microsoft Log Event ID 4625 - Multiple logins failed account ended with $

Recently, we discovered that in some unknown cases windows generates multiple logons failed (log id 4625). In all cases, the linked account name ended with $ that means computer account login failed. ...
-1
votes
2answers
28 views

uninstall / deactivate ssh client only on linux server [closed]

How can I uninstall or completely deactivate ssh client only. I still need server to log in. I just wonna pretend ssh brute force attacks commming out from my server. Thanks in advance.
-2
votes
1answer
33 views

continuous attack on server nginx

nginx access log There is a continuous attack on server and i am not sure from where it happening. if someone can understand and guide me on this.
0
votes
1answer
29 views

Handling ssh brute force attacks from ::1?

I have an Ubuntu server; first I ran into this, as I couldn't log in via ssh at all: ssh connection takes forever to initiate, stuck at "pledge: network" After a hard reboot, I could log ...
0
votes
1answer
37 views

SSH Brute Force Login Attempts - enable automated email to abuse-mailbox

Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the ...
0
votes
3answers
59 views

Sharing IP black lists

Are there any tools similar to fail2ban that would allow sharing of IP black lists? What I'm looking for is something similar to a DNS based blackhole list or real-time blackhole list as is used to ...
0
votes
1answer
118 views

MySQL shutting down on ~ same time and is not starting. Brute Force Attack? Or what?

my portal started to shutting down (1 time a day) and it happening over a week now and i do not know were could issue be. .. MySQL is shutting down on about the same time and is not starting after ...
0
votes
0answers
141 views

Nginx: Rate limit failed basic auth attempts

Given a simple HTTP Basic Auth setup in Nginx (1.14.1 at time of writing) like this: server { ... location / { auth basic "HTTP Auth Required"; auth basic user file "/path/to/htpasswd"; ...
0
votes
0answers
52 views

FIN_WAIT1 issue in apache

My hosting server is having apache issues due to wp-login attack in the server.. I have string blocked them in server firewall and killed the existing connections... however still getting too many ...
7
votes
0answers
116 views

Windows RDP: Attack targeting real account names

We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled. RDP login is not allowed for the Administrator account, and there ...
1
vote
2answers
922 views

Brute Force attack in DirectAdmin

I have problem with brute force monitor in direct admin. Every minute i get info like this: 15705610210001 52.187.17.107 123 1 sshd4 Oct 8 20:56:24 server sshd[10817]: Failed password for ...
0
votes
2answers
288 views

Is it wise to have fail2ban block 301 brute forces when you have http to https redirection enabled?

Recently my servers started getting bombarded by anonymous scanners/brute forces. This is how my nginx access.log looked like after the attacks : xxx.xxx.xxx.xxx - - [07/Sep/2019:23:30:16 +0200] "...
0
votes
2answers
495 views

Stopping SSH brute force from China - fail2ban not working

I see things like this in my /var/log/auth.log sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] sshd[1964]: ...
1
vote
0answers
3k views

How to protect against backdoor attack? [duplicate]

I've been getting strange page accesses showing up in my apache error log recently. It seems as though someone is trying to access /wp-login.php, /elrekt.php and other pages that don't exist. It's ...
1
vote
0answers
38 views

SSH brute-force from my network / domain [duplicate]

Twice a week I receive an email to abuse@mydomain.tld that says: An attempt to brute-force account passwords over SSH/FTP by a machine in your domain or in your network has been detected. Attached ...
1
vote
0answers
24 views

I am getting bruteforce attack from locvangxuanfb2019.com

In my wordpress website, I am getting bruteforce login attempts from locvangxuanfb2019.com and hopquavn2019.com When I try to ping locvangxuanfb2019.com and hopquavn2019.com I get response from ...
0
votes
1answer
715 views

IIS - Detecting Brute Force Logins and Password Spraying

TLDR; What techniques are being used to detect brute force logins and/or password spraying on IIS hosted websites (including SharePoint, OWA, etc.)? ModSecurity There are many tools for other ...
0
votes
1answer
108 views

fail2ban filter matches no lines for xmlrpc attack

I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form [Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
1
vote
0answers
89 views

How to Ban WordPress Brute Force Attack by Client From Apache's Server Status Page?

I have a server hosting multiple domains and protected by Fail2Ban with WP Fail2Ban and wordpress-hard + wordpress-soft rules. Recently I notice that our server is heavily loaded and seems like we ...
0
votes
1answer
65 views

Blocking “pokes” of our system

We get tons of these in our apache error log every day. [Wed Oct 17 03:27:37 2018] [error] [client 103.41.124.159] File does not exist: /var/www/html/phpmyadmin [Wed Oct 17 03:27:37 2018] [error] [...
5
votes
4answers
2k views

How to secure servers from a cgi-bin/php POST request attack

We got a POST request to our server with the following in it: %63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%...
0
votes
1answer
72 views

Block outside TCP requests from centos server

I have a centOS server and user to host web systems with LAMP. Server owners are complaining that we are sending abnormal TCP requests to external server. How can we block these types of requests? ...
0
votes
1answer
193 views

Suspicion of brute force attack on mysql

In these last couple of days, one my vps server has crashed twice for no appearant reasons. All sytems on it are up to date. Fail2ban is installed and jailed as much as usual, I trust the server's ...
1
vote
1answer
456 views

RDP Server under attack; IP address used is our server address

I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses. ...
0
votes
1answer
87 views

My web server is being hit, all resources are maxed out, how to find out the root cause?

Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
1
vote
1answer
264 views

Stop HTTP Post Requests with NGINX Before Hitting WordPress Application Log-in Page

Since the bots send HTTP Post requests directly at the known target /wp-login.php to skip the Captcha, would it be possible to check for a custom Post Input such as the Captcha Input or my own custom ...
1
vote
1answer
272 views

NGINX Brute Force Detection of devices hiding behind NAT. Block only specific device and not all devices sharing the same IP

I have a AWS EC2 Ubuntu instance with NGINX server configured to listen on IP address 50.0.0.1 (Example) on port 80. I have a login page in index.php. I want to configure nginx for brute force ...
0
votes
2answers
267 views

A smart attack on SMTP evading fail2ban

I have an ongoing brute-force attack on my SMTP server in a way that evades typical fail2ban settings: attacks take place from several IPs in the same subnet a single IP attacks in intervals longer ...
0
votes
2answers
289 views

Windows and Apache Block IP by Country

I'm having DDoS attacks and brute force, my clients are only from a Latin American country and I did not find attacks from that country, so I think my solution would be to find a way to block ips from ...
1
vote
1answer
98 views

Brute Forcing IPs

I have random IPs constantly targetting my Apache server. A sample of what I get in my log: 80.108.96.31 - - [18/Aug/2017:16:16:08 +0000] "GET /machine.xml HTTP/1.1" 403 520 "-" "Mozilla/4.0 (...
0
votes
2answers
837 views

Automatic exim4 ban ip

I would like to know if it is possible to automatically ban/filter an IP for few time in case of multiple authentication failure in exim4 server.
0
votes
2answers
3k views

Brute force attack with no IP to trace

I am getting constant event 4625 messages saying that accounts are failing to log in with non-existent usernames. Names such as: SALES, USER, TEST, HELPDESK, SUPPORT, PROGRAMMER are not users of ours, ...
2
votes
1answer
1k views

Auto-ban IP from “wp-login.php” attackers

When I look at my Apache log other_vhosts_access.log, I see many many attempts, from a few different IP per month like this: www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:19 +0200] "POST /wp-...
0
votes
0answers
136 views

How to ban abusers who use my public SOCKS5 proxy server to brutforce 3-rd party sites?

We have been thinking for very long time about it. It's easy to escape abusers who use my server to send email spam by blocking email ports, but how to ban abusers who use my public SOCKS5 proxy ...
2
votes
2answers
7k views

Blocking IPs in HAProxy

A client's website is currently under attack, and I've been called in to fix it. A huge number of IPs (easily over 5,000) is constantly hitting /login, presumably trying to bruteforce their way in. ...
10
votes
3answers
4k views

Securing linux servers: iptables vs fail2ban

I would like to pick the community's brain regarding linux server security, specifically regarding brute-force attacks and using fail2ban vs custom iptables. There are a few similar questions out ...
0
votes
3answers
3k views

Using iptables to prevent SSH brute force attacks and DDOS attacks

I have the following lines at the very top of iptables, these are used to prevent SSH brute force attacks and DDOS attacks: iptables segment to prevent SSH brute force attacks and DDOS attacks What ...
1
vote
1answer
698 views

fail2ban with vsftpd explicit sftp

The fail2ban vsftpd default config doesn't take care of blocking brute force requests when tls is enabled on vsftpd. At the moment the vsftpd log only shows the below lines which don't match the regex....
0
votes
1answer
4k views

Too many TIME_WAIT connections on mysql from an outside host

My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...
2
votes
2answers
2k views

fail2ban reject brute force spam bots

Would it be wise if I modify postfix fail2ban rule from this: failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$ ^%(__prefix_line)sNOQUEUE: reject: ...
1
vote
2answers
672 views

Someone try to hack my server

I have a linux machine running as a test server. My box redirects my port like 80 directly on this machine. I created it to train all kind of things (raid, tcp...). Recently I tried to connect to my ...
1
vote
1answer
1k views

Someone posting to /wp-login.php every 2 minutes. Is it commonly happens?

When I check my nginx access.log there are requests (GET request followed by POST) every two minutes on /wp-login.php. Then I log those POST requests (changing login page to empty page and save POST ...
0
votes
0answers
69 views

is it possible to block proxy (or TOR) connection attempts on my server?

I have a website that gets about 2000 visitors/month, but I'm also getting about 500 break-in attempts per day. In auth.log every few minutes I get a 8 of these: Oct 19 16:34:14 main-srv vsftpd[7361]:...
5
votes
2answers
7k views

Get Fail2Ban To Check findtime Every X Minutes

I have fail2ban set up with the following settings: bantime = 86400 findtime = 600 maxretry = 2 This is great as it stops any IPs who are brute forcing 3 times within 10 minutes. However, there ...
1
vote
1answer
716 views

What Is Better For Security And Performance - APF or Fail2ban?

I have been doing plenty of research on Advanced Policy Firewall (APF) and Fail2Ban. I have a VPS under SSH brute force attack. I'm leaning towards APF and just allowing on my few IPs through. However,...
0
votes
1answer
573 views

Limit Wordpress login to certain ip-addresses on Nginx and PHP-FPM

I've seen a lot of bruce force attacks on Wordpress, so I want to limit access to wp-login.php. It's the latest Wordpress on a Ubuntu 16.04LTS Nginx server with PHP-FPM. I've tried the advice from ...
1
vote
1answer
367 views

How to protect saslauthd from local brute force attack?

There are numerous instructions over the internet to use saslauthd. I've tried to run the service. It gave me a surprise when I discovered that /run/saslauthd/mux socket and /usr/sbin/testsaslauthd ...
1
vote
1answer
145 views

Dealing with Brute Force Attack

For the better part of yesterday (and today so far) my server is being attacked with brute force. I am rather an inexperience admin when it gets passed the basics. I understand how to find things, ...
2
votes
2answers
261 views

Fail2ban regex doesn't match my log

I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it. My log lines looks like these: [Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [...