Multiple IP Brute Force Login Attack CentOS 6

brute-force-attackscentos6.2ip

Currently, one of my websites is being subject to a brute force login attempt. The problem is that it is coming form multiple IP sources. I have a system that auto bans IP after 3 attempts and so far the attacker has tried/banned 800 different IPs. I am not really worried about the username/password list he is using since I can see it as they come in but I guess my only worry is system resources.

Still being somewhat new to this kind of thing, I am not sure if I have any other options. Is there anything else you can do against this kind of attack?

Server is running CentOS 6

Best Answer

As I understand you can detect attacks only on Application Layer (HTTP).

I recommend to use modsecurity for detection and blocking on this layer, also, it can generate dynamic blocks, block requests for some time, run external commands (i.e. add rule to iptables) etc.

Modsecurity will be most effective solution to detect, regarding blocking - you need to block requests on the firewall.

Some block requests with fail2ban, but from my personal point of view it's ineffective.

Related Solutions

Win2008R2 :Brute force attack prevention

If you want to block the ip you can use firewall policies to block the ip. Windows will lock an account and auto unlock it at times specified in the account security policies. This typically prevents brute force attacks, when set at reasonable times, but on an unmonitored server, could lead to a DOS attack. A simple solution is to write a script to parse the logs for account lockouts and after N number of lockouts block the ip. This script can run scheduled at whatever interval makes sense for your situation. An IDS will also solve the issue.

Iptables – block internal ip brute force attack

I just had exactly this same problem. Iptables is a good idea, but you can also use hosts.[allow|deny], which I find is a little easier.

Example

Particularly strict example -- whitelist only. First deny everything:

# cat /etc/hosts.deny
ALL: ALL

And the allow rules:

# cat /etc/hosts.allow
sshd: 192.168.0.100

Also, this is a good article:

http://www.debian-administration.org/article/87/Keeping_SSH_access_secure

Best Answer

Related Solutions

Win2008R2 :Brute force attack prevention

Iptables – block internal ip brute force attack

Related Topic