Hi,

i have someone trying loging whit the
admin login of psa my log are full of that...


xxx.com (213.22.223.117[213.22.223.117]) - PAM(admin): Authentication failure.
xxx.com (213.22.223.117[213.22.223.117]) - PAM(admin): Authentication failure.
xxx.com (213.22.223.117[213.22.223.117]) - PAM(admin): Authentication failure.
xxx.com (213.22.223.117[213.22.223.117]) - PAM(admin): Authentication failure.


Can i ban the IP some way ???

Thanks

Try reading:

man hosts.deny

I believe this is the solution.

Even better, look into iptables. You should be running a firewall anyway, so now is a good chance to set it up. There are some good posts about this on the forum, search arround.

Yep , that post is old a bit :-)

I use Iptables :

/sbin/iptables -I INPUT -s 213.22.223.117 -j DROP

I have user trying admin/root passowrds via ssh almost every day, he is from dialup, because every try he has different IP address. The last two octects only get changed..

how to ban let's say 213.22.*.* ?

I'd notify the ISP if I were you... I'm sure they'll be glad to disconnect him, with a nice bill for his parents

Add a mask:
/sbin/iptables -I INPUT -s 213.22.0.0/16 -j DROP

The /16 refers to the number of bits (from the left) that are significant. Each quadrant is 8 bits.
So:
/32 is all and is the default when no mask is used.
/16 is the most significant 16 bits, or two quadrants. This would block over 65,000 IPs. This may represent even more computers since each IP may be used by more than one computer.

The effects of /24 and /8 should be obvious. I have never tried something like /27 but it should work, just harder to visualize the effect.
Gary

thank you very much for good explanation.

Meanwhile, I have found this calculator for this..

Thanks for that link!

Make sure your server requires two logins. Nobody should ever be logging in as root using SSH, not even you. All logins thru SSH should be to Admin -> then su as root.

Find: /etc/ssh/sshd_config

Find PERMITROOTLOGINS = Yes and change it to No

Restart OpenSSH /etc/rc.d/init.d/sshd restart

Test to make sure you can login as Admin -> then Root by opening a second session. Dont disconnect from the first session. If you can login as Admin then Root your set. If you cant something has been set incorrectly.

If this is a Cpanel box then setup is much harder. You will need to set the wheelgroup to include ADMIN from WHM then make the changes above. Test test test!

This makes it harder for somebody to login and requires two pw's instead of just one.

Hi all.

I started with a Redhat 7.2 Server running Plesk 5.05 (I'm eagerly awaiting the next patch).

I just need to block some rogue ip's that are trying to brute-force attack my members sections by guessing passwords. I'm not really that comfortable with ip chains or iptables--never used either. If the ip's in hosts.deny would just be blocked I wouldn't have a problem with anything.

Do I just need to start /usr/sbin/tcpd and then hosts.deny will work?

If you'd like you can email ME. Helpful people will be rewarded...

check out some of my sites:
www.innocentblueeyes.com
www.shesnoordinarygirl.com
www.gndtv.com
www.thosewahlbergmen.com