Avoiding Port Scanning And Brute Force

Oct 28, 2009

I get a lot of messages from CSF about Port Scanning and Bruteforce detection.. Is there a way to avoid all of these attacks ? Because it tries to figure out my clients ftp or pop3 user with several usernames, i.e. administrator, postgres, mysql, httpd, and many more..

I know a little about internet security.. Is it possible to make my public IP of shared hosting untraceable ? Like this one..

Just do a ping to ebay.com or paypal.com and then you will receive RTO message or Destination host unreachable, but actually the site is running well..

View 5 Replies


ADVERTISEMENT

Brute Force UDP Attack On SSH Port. . Possible/why

Nov 24, 2007

my server is being brute force attacked at port 22.. It caused my server to be blocked by my ISP's upstream...

at first I follow the instruction on this forum showthread.php?t=456571 (can't post link)

but then I realized (from the upstream email, I don't have access to any log on their side) that it was UDP.. not TCP.. but it was said to be brute force attack on SSH port.

Now all I do is moved ssh port.. and then limit the max connection per minute to port 22/UDP like on the above tutorial page..

Is that enough? I can't use IPTables to permit specific IPs, I'm pretty much very mobile so my own IP is different each time.

Any ideas why UDP attack?

Is it possible that brute force attack turned out to be UDP protocol? cause if it's not, then I think my ISP/its upstream can't be trusted..

View 13 Replies View Related

FTP Brute Force

May 19, 2008

I checked my attachments folder in WHMCS dir

There was a file ftpquickbrute_08.05.2008_10_47_08.log
Opened it up it says:

Quote:

FTP Quick Brute (called c99shell v. w4ck1ng-shell (Private Build v0.3)) started at 08.05.2008 10:47:21

No success. connections!

------------------------------------------
Done!
Total time (secs.): 3.2036
Total connections: 101
Success.: 0
Unsuccess.:101
Connects per second: 31.53

View 2 Replies View Related

Flood In FTP And Brute Force

Oct 27, 2008

flood in FTP and brute force

all day i receved msgs of BFD someone trying acess server, how to stop it, exemple:
Executed ban command:

/etc/apf/apf -d 221.186.164.233 {bfd.pure-ftpd}
The following are event logs from 221.186.164.233 on service pure-ftpd (all time stamps are GMT -0500):

Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:37 svr1 pure-ftpd: (?@221.186.164.233) [INFO] New connection from 221.186.164.233
Oct 25 13:52:38 svr1 pure-ftpd: (?@221.186.164.233) [WARNING] Authentication failed for user [router] ....

View 0 Replies View Related

Brute Force Attack On VPS

Jul 1, 2008

Today I woke up to a couple of emails from people in China and India trying to break into my server. Then as I went to login to WHM I get this message:

This account is currently locked out because a brute force attempt was detected. Please wait 10 minutes and try again. Attempting to login again will only increase this delay.

If you frequently experience this problem, we recommend having your username changed to something less generic.

Are there ways that I can prevent these attacks? I know that the IPs involved are getting banned, but are there any other methods I should be taking?

View 14 Replies View Related

Brute Force In CPanel

Nov 2, 2008

Over the last few weeks I've been getting emails from WHM stating "x login failures attempts to account root (system) -- too many attempts from this ip"

These emails have been coming in almost hourly and it seems as though somebody is trying to guess the password to the root account and random other accounts.

For now I reduced the amount of failed login attempts to 2 before cPanel blocks the IP.

Is there any other way I can completely stop this person from even attempting to guess my passwords?

View 8 Replies View Related

Brute Force Attempted Through SSH

Mar 17, 2008

For a company I'm working at, two nodes have been brute force attempted through SSH. I've got the logs from both servers in front of me, but could anyone enlighten me of who the ISP is?

ISP: host-80-241-179-30.deltanet.ge

View 3 Replies View Related

Brute Force Attack

Mar 11, 2008

I have a managed VPS and I haven't really ever paid too much attention to the logs until now.

I noticed that the APF logs indicate a 2-5 attacks on my server attempting to log in via ssh. My system allows 10 minutes of log in failure attacks before apf bans the ip.

To eliminate the method of attack, I see 2 ways. One way is to change the SSH port; the second is to only allow ssh via specified ip's.

What are the pro's and con's of both... also are there other ways to eliminate these attacks via ssh?

View 14 Replies View Related

Brute Force Detection (bfd)

Apr 6, 2007

ive just installed bfd on a new server:

[url]

And im getting the following in an email every 10 minutes:

Code:
/usr/local/bfd/conf.bfd: line 26:
: command not found
/usr/local/bfd/conf.bfd: line 38:
: command not found
/usr/local/bfd/conf.bfd: line 47:
: command not found
/usr/local/bfd/conf.bfd: line 59:
: command not found
/usr/local/bfd/conf.bfd: line 60:
: command not found
/usr/local/bfd/conf.bfd: line 76:
: command not found
/usr/local/bfd/conf.bfd: line 88:
: command not found
The email is being sent from:

Cron Daemon <root@hostname.com> (replaced hostname myself)

Now i know this isnt r-fx networks support but none of there support options seem to work so i figured id post here considering the amount of users that are likely to be using bfd (or you should be)

View 3 Replies View Related

DoD Brute Force Attack

Jan 14, 2007

Ok, this is weird. What do you do when your VPS was submitted to a brute force attack from the U.S Department of Defense?

The IP Whois and Reverse DNS gives me "DoD Network Information Center", why in the world would they try to force access to a small (less than 20 clients) Canadian host?

And in case you're wondering, they don't seem to have any abuse email address.

View 8 Replies View Related

Anti Brute Force Protection

Apr 30, 2009

I have some windows 2k3 and 2k8 win servers and now i must to protect..

I need best free/commercial solution for firewall and anti brute force protection.

View 9 Replies View Related

WHM/Centos/VPS Having Brute Force Attacks

Jan 29, 2008

I am getting these types of reports in my nightly reports:

=================
sshd:
Authentication Failures:
unknown (bips131.bi.ehu.es): 212 Time(s)
mail (bips131.bi.ehu.es): 4 Time(s)
news (bips131.bi.ehu.es): 4 Time(s)
root (bips131.bi.ehu.es): 4 Time(s)
unknown (swplinux02.swp.ewr.qwest.net): 1 Time(s)
Invalid Users:
Unknown Account: 213 Time(s)

Two nights ago:

--------------------- pam_unix Begin ------------------------

sshd:
Authentication Failures:
unknown (195.251.109.21): 413 Time(s)
root (195.251.109.21): 108 Time(s)
webadmin (195.251.109.21): 18 Time(s)
root (200.55.193.59): 16 Time(s)
daemon (195.251.109.21): 8 Time(s)
ftp (195.251.109.21): 5 Time(s)
root (218.19.69.193): 4 Time(s)
Invalid Users:
Unknown Account: 413 Time(s)
===============

My VPS support said I could try:

-alternate sshd port
-require key access
-selecting client ip access
-rate limit incoming sshd syn packets per src address

However, I need some help understanding the best way to address these so that these brute force attacks aren't successful.

View 3 Replies View Related

Brute Force Warning - 11 In 2 Days

Dec 13, 2007

over the last 2 days I've gotten 11 emails telling me about brute force detections on my server, the vast majority of them are for sshd from different IP's.the number of events ranges anywhere from 11 to 515.

View 4 Replies View Related

The Best Firewall And Brute Force Attacks

Jul 10, 2007

What is everybody using?

Is there a "Best"

What do you guys recommend?

I have read about the CSF, is this any good?

View 14 Replies View Related

IIS FTP Brute Force Attack How To Prevent At Network Level

Jan 21, 2008

I am getting a few hundred IIS 6.0 FTP login attempts a second on my windows 2003 x64 server.

We have a Sonicwall TZ180, a full IPS and Firewall in front of the server but I cannot determine a way to block these attacks. I simply have port 25 open to all ip addresses, as I do not know a range of valid ips.

Is there any way to prevent these attacks at the firewall/hardware level? I suspect not, because the firewall doesn’t know if a login attempt is valid or not.

I have enabled IPS on the firewall but doesn’t appear to be stopping these attacks. Is there any way to automatically ban ips that hit port 25 X number of times in a second?

View 6 Replies View Related

Port Scanning

Apr 18, 2009

I have been receiving a lot of emails from LFD about this ip (93.190.138.129) port scanning.

I get about 3+ of these emails a day letting me know that ldf has blocked the ip temporary.

I am now wondering should I be worried about this ip port scanning?

The ip is from the netherlands where my server is hosted and was wondering if its a coincidence or not?

View 11 Replies View Related

Avoiding The Dreaded 777

Apr 16, 2007

Just wondering what options I have so that I can finally be rid of the 777 folders and lower them to 755?

Problem, I run several scripts that I assumed require 777 permissions, such as forums and gallery scripts. How else would images/attachments be uploaded to the server?

I`m running a linux vps, however I`m relatively new to server security and admin stuff.

Reason I brought this up, quite a few of my 777 folders on various scripts had some unwelcome php and htaccess files added over the last few weeks. No doubt malicious! I only just discovered them this evening.

I keep hearing about PHP Suexec and other features, but I`m concerned using these migh kill the attachment features of a forum for example. What good is a gallery if we cannot upload anything.

I know there are ways around this, but I need something in laymans terms.

View 11 Replies View Related

Avoiding Ddos

Oct 22, 2007

security tips to battle against ddos attack?

My server has APF+BFD normal configurations by the manual. Recently I got traffic from router at unusual 16mb traffic

View 3 Replies View Related

Avoiding Bad Web Hosting Neighborhoods

Sep 15, 2008

I volunteer with Spamhaus, the U.K. based anti-spam blocklist. Late last week I was introduced to the Web Hosting Talk forum because a fellow blocklister came under attack by someone who turned out to have quite the record for several types of online lunacy. Since then, I've been reading the board and becoming acquainted with what happens here.

I'm impressed. Most of you appear to be sane :-) and there are some very knowledgeable web hosting professionals here. So I thought I would post about a project I am working on at Spamhaus, and see if I could get some help.

I want to write an article for the Spamhaus web site. It will be aimed at web hosting customers, and will explain how to evaluate ISPs and web hosting providers for security and spam prevention issues. We call this "avoiding bad neighborhoods."

As one forum user (phorum) discovered last week, hosting a perfectly legitimate web site at a rogue provider can mean your web site looses connectivity without warning. Hosting at a bad provider, one that has lax or no abuse enforcement or that deliberately allows spammers to host their web sites on the same IPs as innocent customers, can cause your web site IP to end up on a blocklist despite your having done nothing wrong.

In cases of shared hosting and an indifferent or openly spam-supporting web hosting company, blocklists often find themselves between a rock and hard place: they can list the spammer's IP and hurt innocent customers, or allow the spammer to remain unlisted and hurt innocent users. At some point alleviating the second problem will trump the first.

What we want to do is to provide web hosting customers, especially smaller web hosting customers that may share a server and/or an IP with other web sites, with the tools they need to determine what sort of job their host is doing at keeping a clean network.

Obviously, two of the things to be done are:

* Check reputable blocklists to see how much of a web hosting company's IP space is listed, and (perhaps more important) for how long listings remain active.

* Check reputation services, such at Senderscore.

What other measures would you, as experienced customers of web hosting service, or as web hosting providers, take?

View 14 Replies View Related

Avoiding Billing For Traffic Between Ports

Apr 26, 2008

If I have a customer renting two servers from me, and I collect bandwidth data at the switch port, and he does large transfers between the two boxes that travels through my switch, how do I avoid charging him for that bandwidth? Make him install his own switch? That's the only way I can think to do it. I can limit other people from flooding others on the switch with vlans, but within a vlan, it really isn't fair to bill for traffic that flows between ports, is it?

View 11 Replies View Related

Somebody Is Scanning My Site For PhpMyAdmin

Jul 9, 2009

I found several requests in my error log which looks like someone was scanning my site for phpMyAdmin. This was a newly created subdomain. So I checked my main site and another subdomain and they also contained similar entries. Should I do something?

[Fri Jul 03 03:23:16 2009] [error] [client 65.23.157.214] File does not exist: /var/www/vhosts/mydomain.com/subdomains/mysubdomain/httpdocs/phpMyAdmin
[Fri Jul 03 03:23:16 2009] [error] [client 65.23.157.214] File does not exist: /var/www/vhosts/mydomain.com/subdomains/mysubdomain/httpdocs/phpmyadmin
[Fri Jul 03 03:23:16 2009] [error] [client 65.23.157.214] File does not exist: /var/www/vhosts/mydomain.com/subdomains/mysubdomain/httpdocs/pma ...

View 14 Replies View Related

Website Malware Scanning

Apr 8, 2009

A website I've recently been entrusted with was cracked into via brute force ftp earlier this week. Apparently the bad guys ran a script that added iframe links to every page named index.html. The iframe linked to 3 sites that prompted malware downloads.

I think I've found and removed all the affected code, however I'm looking for an online website scanner that will drill down through all the links on a given site and search the code for similar problems.

I've only found a couple of these so far and they don't seem to fit the bill; was wondering if anyone here had recommendations or experience with similar tools...

View 1 Replies View Related

PCI Scanning On A Shared Server (UK)

Aug 23, 2009

Does anyone have experience of PCI DSS scanning on a shared server? Our current hosting company have told us that it's unlikely to pass on a shared server, and that we should move to a Virtual Managed Server for them to make the necessary changes to pass a PCI scan.

In particular, we're talking PCI compliance to use PayPal website payments pro UK.

From Googling there seems to be a lot of debate on this issue - varying from 'all you need for PCI compliance is a SSL certificate' (this seems to be paypals attitude), to 'PCI scans can be passed on a shared server if your host is willing to help' to 'you need separate dedicated servers for the database and site etc'.

Does anyone use website payments pro UK, have a shared server, and regularly pass quarterly PCI scans? Also, we would much prefer a host based in the UK - we seem to get much better performance from our UK host than we did when the site was hosted in the US (our customers are almost completely UK based).

View 6 Replies View Related

IANA Scanning Ports

Dec 3, 2007

My internet security software blocked port scanning from IANA
Internet Assigned Numbers Authority. Who is this and what are they doing scanning the ports on my computer.

View 2 Replies View Related

Scanning A Site Against Intrusions And Security Holes?

Apr 21, 2008

What do you recommend for scanning a site against intrusions and security holes?

View 1 Replies View Related

Modsecurity Clamav Upload Scanning Doesn't Work

Jul 12, 2007

So I've been working on getting the modsecurity upload scan function to work for over 4 hours now and i'm done with this junk to say the least.

Using modsec 1.9
Cpanel 10x
Apache 1.3

in the modsec.conf

SecUploadDir /tmp
SecUploadApproveScript /usr/local/apache/htdocs/upload_scan.pl

All I get in the audit_log is:

Access denied with code 406. Error verifying files: Received no output from the approver script (execution failed?) "/usr/local/apache/htdocs/upload_scan.pl" ....

View 1 Replies View Related

Disable File Attachment Scanning & Extractinig At MailScanner

Mar 9, 2007

My main goal was stopping incomingo spam.. and MailScanner is doing a great work on that.. but, it is taking too much time extracting and scanning attachments... does anyone know how to disable scanning the attachments ?

This is my top output from MailScanner running:

Code:
12:10 3 MailScanner: extracting attachments

View 0 Replies View Related

FreeBSD: Sendmail To Exchange. No Scanning E-mail Process

Aug 16, 2007

I tried to configure Sendmail as e-mail MTA with ClamAV & SpamAssassin before my local network. I can send and receive e-mail but spamassassin doesn't filter them. Do you know where I should look for?

View 2 Replies View Related

Unable To Open Spam.scanning.rules - MailScanner

Mar 5, 2007

I was trying to install mailscanner on a cpanel box using chirpy's script [url], followed every step, until this:

Code:
[root@server.yourbox.com:~]perl mscpanel.pl -i
Unable to open spam.scanning.rules for reading: file or directory doesnt exist at mscpanel.pl line 115.
On the 115 line i found this:

Code:
open (IN, "</usr/mailscanner/etc/rules/spam.scanning.rules") or die "Unable to open spam.scanning.rules for reading: $!";
The file /usr/mailscanner/etc/rules/spam.scanning.rules just doesnt exists... maybe chirpy's script is not working well installing everything its needed..

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved