I'm wanting to run a publicly accessible server for web hosting. I'm interested in preventing brute force attacks made against PHPMyAdmin or any other form of authentication process I may include in the site.

What types of options exist for this without having to monitor every possible login method that may exist that I actually want public facing?

I use Fail2ban to block things like too many ssh attempts. I also just started using it for stopping too many PHPMyAdmin login attempts. My concern are other arbitrary login pages that my web developer may create for things specific to the website.

Initial thoughts were things like stopping too many requests per X seconds. That, however, would have to be a rather high number to accommodate pages with lots of images and sounds like it would have a lot of room for false positives.

I would think this would be similar to how a shared hosting provider would help keep your website secure when they have no idea what content you may have (a bank would obviously not host that kind of information with a shared provider, but many less sensitive sites would still want to keep logins from being brute forced). Perhaps this is the reason for captchas?

  • First of all do not use a phpmyadmin accessible on internet or from a dummy folder like http://myurl.com/madnessisnowafriend instead of using a more standard http://myurl.com/phpmya http://myurl.com/pma or http://myurl.com/phpmyadmin then if you want to secure an apache, consider using and configuring mod_secure – Kiwy Dec 5 '13 at 16:15
  • On the developer's side of things, captchas defeat brute-force attacks unless the captcha itself can also be defeated. – Nathan C Dec 5 '13 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.