What additional measures to take if the server is attacked in order to guess the password?

L

LyWf2014-02-28 10:22:24

System administration

LyWf, 2014-02-28 10:22:24

There is a dedicated server on Debian6. It is knocked on by automatic password guessing requests.
Knocking mainly on ssh and ftp.
Fail2ban is installed on the server, so there is no particular concern that they will be able to guess the password.
Still worrying is the fact that this has been going on for the fifth day. They knock hard enough - I was forced to unscrew the ban time to 24 hours. Nevertheless, once a day I receive a couple of letters about banned IPs and have already collected about 12 different IPs.
Perhaps some additional steps should be taken?

Reply

Answer the question

In order to leave comments, you need to log in

7 answer(s)

A

Andrew, 2014-02-28
@LyWf

12 different ip in 5 days? Yes, just calm down.

S

sonik_spb, 2014-02-28
@sonik_spb

12 for 5 days banned is minuscule =) Change the sssh port to a non-standard one if it bothers you that much. And if you continue to try to guess the password, then already strain =)

P

Puma Thailand, 2014-02-28
@opium

Do not use stupid passwords and no file2ban is needed.
For 10 years, I have not been hacked into a single server for password guessing, without any file2bans, the search is always going on, around the clock, for years.
Hundreds of servers passed through me.

V

Vitaly Niksenkin, 2014-02-28
@404666

just make access from your ip , lay everything else

V

Vlad Zhivotnev, 2014-02-28
@inkvizitor68sl

It is high time to refuse from ftp for a long time already.
And for ssh, you can disable authorization by root password (or completely disable it), walk by keys.
But overall, it's funny.)

E

Evgeny Elizarov, 2014-02-28
@KorP

log # cat messages | grep [email protected] | wc -l
43
and that's just for this week, and it's just a home server :)) fail2ban works fine. banning root login via sssh really solves the issue of restful sleep :)

O

Oleg Voitenko, 2014-06-27
@OliverV

Set Fail2ban if it's a *NIX Axis. it helps very well when the dad-admin is not temporarily on the server.
A very flexible thing to set up. The Chinese are constantly attacking me with brutes, but everyone goes into the garden thanks to the feiltuban. Three times I didn’t hit (you can configure more attempts or less) by password and truncated, ulitel in REJECT by ip. Supports ftp http smtp ssh control and a bunch of other servers to protect against brute force. But I have to warn you, if the admin makes a mistake while typing the password, he will also fall into the reject, and he will have to log in from another ip to remove the old ip from the reject.