DirectAdmin's Brute Force Monitor (BFM) reads service logs and counts failed logins per IP address and per user. When a threshold is reached it can notify you and block the IP through the server firewall. Configured well, it stops password-guessing attacks on DirectAdmin, SSH, FTP, IMAP, POP3 and SMTP.
Before you start
- Admin access to DirectAdmin.
- A firewall integrated with DirectAdmin. Current versions ship with a built-in firewall based on nftables/iptables; many servers use CSF (ConfigServer Security & Firewall).
- Your own IP addresses to whitelist. Check them with the IP checker.
Open Brute Force Monitor
Go to Security → Brute Force Monitor at Admin Level. The tabs show IP Info (offending addresses), User Info (accounts being attacked), Log Entries and Blocked IPs.
Set thresholds
- Go to Server Manager → Administrator Settings (or Admin Settings).
- Find the Security section.
- Tick Parse service logs for brute force attacks.
- Set Notify Admins after an IP has X login failures, for example 100.
- Set Blacklist IPs after X failed attempts (or block IPs), for example 10.
- Set Clear failed login attempts after X days, for example 1.
- Click Save.
Connect to the firewall
For automatic blocking, DirectAdmin calls a block script when the threshold is reached. With the built-in firewall this works out of the box. With CSF, install the block_ip.sh and unblock_ip.sh scripts from DirectAdmin's documentation into /usr/local/directadmin/scripts/custom/, or install CSF using CustomBuild, which configures it for you:
cd /usr/local/directadmin/custombuild && ./build set csf yes && ./build csfWhitelist your addresses
- Add trusted IPs (office, monitoring, your billing server) to the IP whitelist in Brute Force Monitor or to
/usr/local/directadmin/data/admin/ip_whitelist. - With CSF, also add them to
/etc/csf/csf.allow.
Unblock an IP
- Open Security → Brute Force Monitor → Blocked IPs.
- Search for the address, tick it and click Unblock.
- Ask the user to fix the cause, usually an email client or phone with an old password.
With CSF on the command line: csf -dr 198.51.100.20.
Protect attacked users
In User Info, accounts with many failures are clear targets. Ask those users to set strong passwords and enable two-step authentication. Admins and resellers should always use 2FA.
Troubleshooting
- No IPs ever blocked: blocking is not connected to a firewall, or the threshold is too high.
- Customers blocked repeatedly: a device keeps retrying an old password. Unblock, then update the password on all devices.
- Admin locked out: use your provider's console, for example the Virtualizor VNC console, and unblock your IP from the shell.