I'm wanting to run a publicly accessible server for web hosting. I'm interested in preventing brute force attacks made against PHPMyAdmin or any other form of authentication process I may include in the site.
What types of options exist for this without having to monitor every possible login method that may exist that I actually want public facing?
I use Fail2ban to block things like too many ssh attempts. I also just started using it for stopping too many PHPMyAdmin login attempts. My concern are other arbitrary login pages that my web developer may create for things specific to the website.
Initial thoughts were things like stopping too many requests per X seconds. That, however, would have to be a rather high number to accommodate pages with lots of images and sounds like it would have a lot of room for false positives.
I would think this would be similar to how a shared hosting provider would help keep your website secure when they have no idea what content you may have (a bank would obviously not host that kind of information with a shared provider, but many less sensitive sites would still want to keep logins from being brute forced). Perhaps this is the reason for captchas?