Home › Forums › BlockHosts

nighttime attack

Wed, 2007–Jun–06

Last night (in low traffic conditions) I got 1 attack on ftp server.

The attacker made 1 single connect and then it made about 3000 failed logins before another user spawned the blockhost script which blocked the attack.

My question is: Is it possible to schedule a blockhost scan at regular intervals in addiction to the spawned processes to fix this situations?

Thanks for your help.
Frank

‹ Can't open or read: /var/log/secure Please help me get this working. ›
Wed, 2007-06-20 18:43 — ac

vsftpd?

What FTP server is this - vsftpd? There are some postings on vsfptd in this forum - the older versions are not really suitable for blockhosts - even if you use crontab entries to scan at regular intervals, vsftpd uses a single process to continue to serve login requests, no way to stop it.
I understand the newer versions have a configuration setting that exists the vsftpd server after a fixed number of failures.