Blacklisting/blocking IP's

[ryand]

In the 1.40 latest release there are a couple of features that did not show up on my installation. Is there something you need to install as a prerequisite in order for the options to show up in the Brute force monitor area?

Add Block IP button to IP/User tables for faster blocking (SKINS)
http://www.directadmin.com/features.php?id=1250

IP ranges and reverse IPs in brute_skip.list (SKINS)
http://www.directadmin.com/features.php?id=1252

 

[scsi]

If you use a custom skin you have to add them manually to the skin.

 

[ryand]

I am using all of the default settings including the skin

 

[ryand]

If you use a custom skin you have to add them manually to the skin.

I am trying to find where I would edit the skin thats currently running and I can't even find that.. not that I would know how to put it in there even if I found it kinda new to Directadmin

 

[scsi]

I would just look at http://directadmin.com/demo.html and see how yours is different.

You could also make sure you have bruteforce enabled first.

This command should tell you if it is enabled or not:

/usr/local/directadmin/directadmin c | grep -i bruteforce

1 = enabled
0 = disabled

|*if HAVE_BLOCK_SH="1"|

This might mean you have to have a block_ip.sh file in order for it to show.

You might have to check http://directadmin.com/versions.php and put in keyword brute to find out how to set it up. Also search the forums for bruteforce or block_ip.sh

I dont use the bruteforce stuff at all.

 

[ryand]

I would just look at http://directadmin.com/demo.html and see how yours is different.

You could also make sure you have bruteforce enabled first.

This command should tell you if it is enabled or not:

/usr/local/directadmin/directadmin c | grep -i bruteforce

1 = enabled
0 = disabled

|*if HAVE_BLOCK_SH="1"|

This might mean you have to have a block_ip.sh file in order for it to show.

You might have to check http://directadmin.com/versions.php and put in keyword brute to find out how to set it up. Also search the forums for bruteforce or block_ip.sh

I dont use the bruteforce stuff at all.

well it appears I do have it.

/usr/local/directadmin/directadmin c | grep -i bruteforce
bruteforce=1

What do you use instead of this utility to block people that appear to be phishing for compromised accounts? I have a certain ip that has hit my server 1400 times so far and every username is different.

 

[ditto]

...What do you use instead of this utility to block people that appear to be phishing for compromised accounts? I have a certain ip that has hit my server 1400 times so far and every username is different.

I use http://configserver.com/cp/csf.html it also have a DirectAdmin plugin. It works very well for us.

 

[ryand]

I use http://configserver.com/cp/csf.html it also have a DirectAdmin plugin. It works very well for us.

Thank you very much. I have used plesk since 2003 and just recently switched to DirectAdmin so I am still trying to figure out all of the tips and tweaks. I used to use an add-on called ASL for plesk and I have found they recently came out with a version thats compatible for DA but not for the custom compiled version. They are working on a beta for that however.

This tool you suggested is a great one in the mean time!