Tearabite

For the last few days i've been seeing the same IP attempted logons via varius ports thousands of times.
How/where can i block this IP?
If i block it via HTACCESS that wont work because he's not trying to log into the site itself, right?

Perhaps i should post the IP here so that everyone can block it also?

Gaia

You can block the IP in cPanel by going to the IP Deny Manager. I'm pretty sure that will give him a Server Not Found or Forbidden page when he tries to access your domain.

__________________
||http://eternal-realm.net
||http://usebbzone.com
---------
Go There: Surpass Wiki
----------
|| SH106

mr_fern

Blocking through cpanel is the same as blocking in htaccess, which only applies to for access to the domain (and port 80).

If you want to block the IP completely, you'll need to log into SSH and block the ip using iptables

at the prompt, type:

iptables -I INPUT -s IP_ADDRESS_HERE -j DROP

which should block all requests that come in from that IP address

__________________
Nobody doing nothing

Tearabite

It looks like all that does is add the IP to my hTACCESS file (because i see on that screen other IP's that have been previously added to htaccess)..

Will this prevent attempts to log into other ports/services such as FTP, email, etc?

lonelydreamer

Put in a support ticket, they should be able to help you.

Tearabite

I'm going to read up on the iptables option..

I've gone thru more logs and it seems there are many others banging away on my server (only not as bad as this particular one) .. Am i right in assuming that this is just a loosing battle of wack-a-mole and I shouldnt bother trying to block them or report them to their ISP?

FWIW, i reported these hack attempts to the ISP that owns the IP address - their AUP dept responded and said the customer had been warned/notifed. I assume this means that some 15 year old kid is going to get yelled at by his parents tonight..

Jesse

Doh, my parents just yelled at me for some stupid reason about the internet! ... hehe JK
(I'm not really 15 anyhow :X)

Anyways, you can block IPs, ip ranges, set rules for events and if triggered can block ips. Also there many types of firewalls out there. What may work best for you is BFD (anti-brute force) accompanied by a firewall. This will basically help in rejecting alot of the unnecessary connection attempts and perhaps any successful ones :X

If you want this done, just shoot the helpdesk a ticket and we can get something installed for you.

__________________
Jesse C.
Surpass Techie

Laibeus Lord

I am assuming those attempted logins were attempts to login via SSH.

If so, install this to your box DenyHosts -> http://denyhosts.sourceforge.net or ask Surpass to install it for you. That will help you curb the SSH login spam, which is eating your resources in the long run

Island

APF firewall is still a good option too.
http://www.rfxnetworks.com/apf.php
Once installed you can add the offending IP's to deny_hosts.rules

__________________