Brute Force Monitor and Multi Server

[jkirker]

Is it possible to have the Brute Force Monitor join forces with other machines in a multi-server environment?

Or, is it possible to have CSF cluster ban IP's based on Brute Force attempts?

It could be a great little add if it's not already possible...

It drives me nuts manually adding these IP's to my CSF cluster deny list.

John

 

[zEitEr]

Hello,

Try this guide to set CSF to work in a cluster:

https://www.solid-hosting.net/blog/administration/how-to-configure-csflfd-to-work-in-a-cluster/

p.s. did not test it myself.

 

[jkirker]

Thanks Alex,

I'm going to try increasing my ip_deny limits - perhaps there are just so many the major offenders are just cycling out.

John

 

[zEitEr]

I like your idea with Brute Force Monitor blocking IPs via Multi Server feature.

Regarding CSF and BFM, do you have installed scripts to blocks IPs (in CSF) found by BFM?

 

[jkirker]

Regarding CSF and BFM, do you have installed scripts to blocks IPs (in CSF) found by BFM?

I don't believe so - by that you mean this right? http://help.directadmin.com/item.php?id=380

But again, this would only be on a server by server basis unless there was another process to merge the files from multiple machines, de-dupe the lists and then distribute them, correct?

Any direction that you can point me in would be helpful.

And again, it's very possible that the IP limits were too low and because there is such a constant stream of treats/attempts that they just keep falling off the list after a day or so.

 

[zEitEr]

The guide id=380 is for raw iptables, it might not work with CSF.
So you should try the 3rd option here: http://help.directadmin.com/item.php?id=527

 

[jkirker]

That won't do the cluster blocking though right?

 

[zEitEr]

It will allow to block IPs from Directadmin by CSF. And if you've got a cluster configured in CSF then it should do what you are looking for.