Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I updated my server yesterday to a new version of CentoOS including a new version of DirectAdmin panel. This new installation comes with Brute Force Monitor service.

As far as I see, this BFM protects brute force tries. In just 24h of this new server, I see that my 5 sites had 10,000 brute force tries. Basically I see creatures from mud, scum, trying to use my mail server (dovecot) to send emails and also attacks to gain access thru ssh. Apparently these attacks are failing.

My questions are:

  1. are these attacks really failing?
  2. what kind of protection is given by this BFM service? I ask this because I see some entries on BFM log reporting 4265 tries of the same IP? How is this allowed, isn't reasonable for BFM to ban that IP after 3 or 5 wrong tries?
  3. should I be worried?
  4. how can I protect my mail server even more?

thanks

share|improve this question
    
This question is borderline here — it's mainly about BFM, and about the security of your server in a more holistic manner. It would be more at home on Information Security. If you want, your question can be migrated there: flag a moderator if you want the question to be migrated (do not repost). –  Gilles Jan 13 '13 at 23:18
add comment

3 Answers

up vote 3 down vote accepted

BFM only blocks addresses which try to brute force DirectAdmin itself; for other services it only notifies you.

If you want something which will actually block addresses which attempt to brute force other services, try fail2ban.

share|improve this answer
    
+1'ed for mention of fail2ban –  Shadur Jan 14 '13 at 11:19
add comment

According to the documentation this BFM does not do anything at all. It just looks at some log files and tells you what it thinks about it...

Yes, we are living in a evil world. There are many botnets around trying to get into any server they find. - That is just "normal" in the open internet.

But you shouldn't be scared of this. They can only be successful if you provide some kind of service and either use a very weak password or an old vulnerabe version of the software.

You can check with netstat -tupln what services are accessible from outside. If you don't need a service shut it down or add some firewall rules to limit accessibility.

If you need that service to be accessible from anywhere, make sure you only allow encrypted access and good passwords. Having a look at the log files from time to time might be a good idea, too. If you are annoyed by the brute force attempts you can also change the port of your service.

For some specific piece of software like your mail server. Have a look at the documentation. Often you can set some options to restrict access even further. But that depends for example if you only host mails for yourself or for lots of people all around the world.

share|improve this answer
    
OK thanks. After reading this I made a few changes on some ports and they are now not reaching the site... thanks. –  Digital Robot Jan 14 '13 at 0:39
add comment

I would try to be short.

  1. yes. If a monitoring stand for failing attacks this must be true. (But real danger come from what was not seen! ;-)
  2. BFM stand for Brute Force Monitor try to detect repetitive failed request to block them (by blocking ip for some time, for sample). The advantage of doing this is mostly to keep your mail.log readable (stop them growing a lot). But: see later, point 4.
  3. No, but yes... No system is really secure, so more you know about how this work more you become robust...
  4. Keep your installation up to date. The most important security failures are patched, tested, verified and diffused in less than 24 hours, from the publication of faillure upto package upgrade publication.
share|improve this answer
    
thanks. I did a few port changes on the server and tries reduced drastically. They are probably trying on standard ports and getting kicked out. 98% of attacks were on dovecot. Some scum trying to send spam using my server... –  Digital Robot Jan 14 '13 at 0:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.