I updated my server yesterday to a new version of CentoOS including a new version of DirectAdmin panel. This new installation comes with Brute Force Monitor service.

As far as I see, this BFM protects brute force tries. In just 24h of this new server, I see that my 5 sites had 10,000 brute force tries. Basically I see creatures from mud, scum, trying to use my mail server (dovecot) to send emails and also attacks to gain access through ssh. Apparently these attacks are failing.

My questions are:

  1. Are these attacks really failing?
  2. What kind of protection is given by this BFM service? I ask this because I see some entries on BFM log reporting 4265 tries of the same IP? How is this allowed, isn't reasonable for BFM to ban that IP after 3 or 5 wrong tries?
  3. Should I be worried?
  • 1
    This question is borderline here — it's mainly about BFM, and about the security of your server in a more holistic manner. It would be more at home on Information Security. If you want, your question can be migrated there: flag a moderator if you want the question to be migrated (do not repost). – Gilles 'SO- stop being evil' Jan 13 '13 at 23:18

BFM only blocks addresses which try to brute force DirectAdmin itself; for other services it only notifies you.

If you want something which will actually block addresses which attempt to brute force other services, try fail2ban.


According to the documentation this BFM does not do anything at all. It just looks at some log files and tells you what it thinks about it...

Yes, we are living in a evil world. There are many botnets around trying to get into any server they find. - That is just "normal" in the open internet.

But you shouldn't be scared of this. They can only be successful if you provide some kind of service and either use a very weak password or an old vulnerabe version of the software.

You can check with netstat -tupln what services are accessible from outside. If you don't need a service shut it down or add some firewall rules to limit accessibility.

If you need that service to be accessible from anywhere, make sure you only allow encrypted access and good passwords. Having a look at the log files from time to time might be a good idea, too. If you are annoyed by the brute force attempts you can also change the port of your service.

For some specific piece of software like your mail server. Have a look at the documentation. Often you can set some options to restrict access even further. But that depends for example if you only host mails for yourself or for lots of people all around the world.

  • OK thanks. After reading this I made a few changes on some ports and they are now not reaching the site... thanks. – SpaceDog Jan 14 '13 at 0:39

I would try to be short.

  1. yes. If a monitoring stand for failing attacks this must be true. (But real danger come from what was not seen! ;-)
  2. BFM stand for Brute Force Monitor try to detect repetitive failed request to block them (by blocking ip for some time, for sample). The advantage of doing this is mostly to keep your mail.log readable (stop them growing a lot). But: see later, point 4.
  3. No, but yes... No system is really secure, so more you know about how this work more you become robust...
  4. Keep your installation up to date. The most important security failures are patched, tested, verified and diffused in less than 24 hours, from the publication of faillure upto package upgrade publication.
  • thanks. I did a few port changes on the server and tries reduced drastically. They are probably trying on standard ports and getting kicked out. 98% of attacks were on dovecot. Some scum trying to send spam using my server... – SpaceDog Jan 14 '13 at 0:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.