how to set ftp/smtp failed login auto block ip？

[msn512msn]

how to set ftp/smtp failed login auto block ip？

eg the direct admin login failed in 5time and will auto block ip
to prevent hack ?

how to do ? any guide ? tq everyone

 

[zEitEr]

With that information, you've given, nobody probably will be able to help you. You didn't specified your OS type. What are running there? FreeBSD? CentOS? Debian? Other?

If Linux OS usually use iptables, then FreeBSD uses ipfw, ipfilter. And they differ in syntax of commands and in logics.

Thus, you might find these links helpful:

Brute Force IP Info Page and custm block_ip.sh
Brute Force log scanner
I wish to have a block_ip.sh so I can block IPs through DirectAdmin

General things you should do is to
1. configure BFS on page "Set Admin Settings" (admin level login into Directadmin).
2. create /usr/local/directadmin/scripts/custom/block_ip.sh and put there instructions, according to your OS type and firewall, you're running there, of course if any...

Note, the last link in my list has already a working step-be-step how-to for Linux based OS with iptables.

 

[msn512msn]

hi thanks for your reply
i use CentOS 5.0 so how to do?

 

[zEitEr]

Did you read any article? The last link in my list (see previos post) has already a working step-be-step how-to for Linux based OS (including CentOS) with iptables.

 

[msn512msn]

hi so you sure
http://help.directadmin.com/item.php?id=380
this can auto block ip in ftp and smtp when user failed login in setting time?
thank you~

 

[SeLLeRoNe]

No one will auto block.

That feature into directadmin BFM is not implemented.

You should use the links zeiter gave you and READ them.

Regards

 

[zEitEr]

@msn512msn,

And here we read again this:

4) This last step is optional and should only be used after you've tested the above setup for a while to get comfortable that you're not going to block yourself. The block_ip.sh is only used for an active "click" by the Admin, it does not automate blocking. To automate blocking, create:

/usr/local/directadmin/scripts/custom/brute_force_notice_ip.sh

and this:

Notifications will be sent to all Admins on the system after an IP makes x number of attempts on any account:
ip_brutecount=20

or a user account received x number of attempts from any IP:
user_brutecount=20

So make the script /usr/local/directadmin/scripts/custom/brute_force_notice_ip.sh and set ip_brutecount and user_brutecount to 5.


Are you sure you want to block everybody after 5 failed login attempts?

 

[msn512msn]

hi so mean setting this = set all port ? include msql,ftp,smtp,pop port ?
i thing will set eg 30times to prevent password hack.... thank you so much

 

[zEitEr]

msql?

FTP/SMTP/POP are included.

 

[msn512msn]

hi
i was try the tutorial
i don how to type command to edit and save file

#!/bin/sh
SCRIPT=/usr/local/directadmin/scripts/custom/block_ip.sh
ip=$value $SCRIPT
exit $?;

how to edit and add this ?

i was chmod the brute_force_notice_ip.sh to 700
but now
i cannot login to server with putty ?
network error ：connection refused
?

 

[SeLLeRoNe]

Probably you get banned from firewall?

Can you access in DirectAdmin? If yes should be just ssh related problem, disable csf and you should be able to log back using ssh.

 

[msn512msn]

hi
can i ask csf is what ? how to disable ?

i based this tutorial http://help.directadmin.com/item.php?id=380
iptable

and you know which command can edit the file and save ?
tq

 

[msn512msn]

all can access include direct admin,ftp

but only ssh

 

[zEitEr]

*** Note that it opens ssh on port 22, so make sure you either change it manually, or have physical access to your server if you're running ssh on some other port.

http://help.directadmin.com/item.php?id=380

You need to clear /etc/init.d/iptables and restart the server.

You can clear /etc/init.d/iptables from directadmin... File Editor, add /etc/init.d/iptables in /usr/local/directadmin/data/templates/edit_files.txt (take care of syntax), then open /etc/init.d/iptables in File Editor and clean it. After that you might need to restart the server.

p.s. I can not guaranty that you won't break anything. I can only give you guaranties for what I do myself. And my work will cost you some dollars.

 

[msn512msn]

hi
i want ask
i was intall the csf ConfigServer Security & Firewall - csf v5.36

everyone know how to set the ftp/smtp/msql wrong login setting time will auto block ip?
how to set in direct admin ?
i was go the CMD_PLUGINS_ADMIN/csf/index.html

SECTION:Login Failure Blocking and Alerts in direct admin

but i don know how to set ?

 

[zEitEr]

Do you realy have mSQL?

 

[msn512msn]

hi

i want ask
i was intall the csf ConfigServer Security & Firewall - csf v5.36

everyone know how to set the ftp/smtp wrong login setting time will auto block ip?
how to set in direct admin ?
i was go the CMD_PLUGINS_ADMIN/csf/index.html

SECTION:Login Failure Blocking and Alerts in direct admin

but i don know how to set ?

ps :// how to do ? tq...