Brute Force Warning for host.webhost.com

[zolee1]

Hi,

I have been getting these messages by email from my vps:

The remote system 171.64.119.43 was found to have exceeded acceptable login failures on host.europuppy.com; there was 1926 events to the service sshd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.

Executed ban command:
/etc/apf/apf -d 171.64.119.43 {bfd.sshd}

The following are event logs from 171.64.119.43 on service sshd (all time stamps are GMT -0400):

Oct 15 18:16:26 host sshd[6491]: Failed password for invalid user Kaiser from 171.64.119.43 port 35768 ssh2 Oct 15 18:16:26 host sshd[6541]: Invalid user candy from 171.64.119.43 Oct 15 18:16:26 host sshd[6541]: Failed password for invalid user candy from 171.64.119.43 port 35816 ssh2 Oct 15 18:16:27 host sshd[6656]: Invalid user venice from 171.64.119.43 Oct 15 18:16:27 host sshd[6656]: Failed password for invalid user venice from 171.64.119.43 port 35875 ssh2 Oct 15 18:16:28 host sshd[6706]: Invalid user venice from 171.64.119.43 Oct 15 18:16:28 host sshd[6706]: Failed password for invalid user venice from 171.64.119.43 port 35934 ssh2 Oct 15 18:16:29 host sshd[6758]: Failed password for ftp from 171.64.119.43 port 36001 ssh2 Oct 15 18:16:30 host sshd[6786]: Invalid user mozilla from 171.64.119.43 Oct 15 18:16:30 host


I don't want to put the whole log in here...

I had my SSH port relocated from 22 to a 4 digit numbered port.

I have three questions:
1. What can I do to stop these attacks
2. Does the message mean that 171.64.119.43 has been banned, and can’t access our website either?
3. If yes, is it possible to ban this IP from all port but the www port?

Thanks, Zoltan

[Robert]

Hi there,

1. There is not much that can stop attempts. If it's public, chances are it will be attacked. Some of my servers recieve over 50 attempts a day. :( The best thing you can do is put SSH on a non-standard port. That will stop a number of attacks that simply try to connect on the standard port.

2. It means they're 100% blocked from the server. They cannot send mail to your server, cannot access Apache, FTP, etc. Your server will 100% ignore everything from that IP.

3. It might be technically possible, but would require quite a bit of manual hacking to APF/BFD. I generally just say no regarding it. APF/BFD's standard policy is to just add the IP to the drop list and ban it as instead of attacking SSH this time, it could try to attack Apache later.

[Fred]

but these attacks are mostly done by bots on a hacked server or machine... you don't need these machine to access your www and IMO, i feel secure knowing that my whole server is not accessible for them...

If they are hacked, they are not limited to one bot... They could have a bot looking for php vulnerabily and scanning the same IP range that was scanned with ssh... anopnymous ftp bot or whatever bot...

Better have them completly banned!

[zolee1]

Thanks Guys