How secure my server is… should I worry? How to increase protection

Question

I updated my server yesterday to a new version of CentoOS including a new version of DirectAdmin panel. This new installation comes with Brute Force Monitor service.

As far as I see, this BFM protects brute force tries. In just 24h of this new server, I see that my 5 sites had 10,000 brute force tries. Basically I see creatures from mud, scum, trying to use my mail server (dovecot) to send emails and also attacks to gain access thru ssh. Apparently these attacks are failing.

My questions are:

1. are these attacks really failing?
2. what kind of protection is given by this BFM service? I ask this because I see some entries on BFM log reporting 4265 tries of the same IP? How is this allowed, isn't reasonable for BFM to ban that IP after 3 or 5 wrong tries?
3. should I be worried?
4. how can I protect my mail server even more?

thanks

Answer 1

BFM only blocks addresses which try to brute force DirectAdmin itself; for other services it only notifies you.

If you want something which will actually block addresses which attempt to brute force other services, try fail2ban.

Answer 2

According to the documentation this BFM does not do anything at all. It just looks at some log files and tells you what it thinks about it...

Yes, we are living in a evil world. There are many botnets around trying to get into any server they find. - That is just "normal" in the open internet.

But you shouldn't be scared of this. They can only be successful if you provide some kind of service and either use a very weak password or an old vulnerabe version of the software.

You can check with netstat -tupln what services are accessible from outside. If you don't need a service shut it down or add some firewall rules to limit accessibility.

If you need that service to be accessible from anywhere, make sure you only allow encrypted access and good passwords. Having a look at the log files from time to time might be a good idea, too. If you are annoyed by the brute force attempts you can also change the port of your service.

For some specific piece of software like your mail server. Have a look at the documentation. Often you can set some options to restrict access even further. But that depends for example if you only host mails for yourself or for lots of people all around the world.

Answer 3

I would try to be short.

1. yes. If a monitoring stand for failing attacks this must be true. (But real danger come from what was not seen! ;-)
2. BFM stand for Brute Force Monitor try to detect repetitive failed request to block them (by blocking ip for some time, for sample). The advantage of doing this is mostly to keep your mail.log readable (stop them growing a lot). But: see later, point 4.
3. No, but yes... No system is really secure, so more you know about how this work more you become robust...
4. Keep your installation up to date. The most important security failures are patched, tested, verified and diffused in less than 24 hours, from the publication of faillure upto package upgrade publication.