Found several attempts from an IP address in Russia that is attempting a brute force attack
on a sites wp-login.php script. I see every few seconds an attempt in the users domlogs file.
This causes the servers load to increase, and as soon as I block the IP, the load comes down.
Can lfd monitor these logs as well, and block IP's that hit this same link more than 200 times in 5 minutes, or will that be too much strain on the server?
Err.. That would mean I would need to install that plugin for any of my wordpress customers.
Not really an option since we have hundreds of wordpress customers per server. Most of our customers are
not even aware that this is happening to their site.
But thanks for sharing the link, I will definitely send it to some of the customers that have this happen more often then the rest.
- Recompile Apache with mod_security
- Download and install the free GotRoot mod_security ruleset (take note of the specific addendum on cpanel installs on that page): http://atomicorp.com/wiki/index.php/Ato ... stallation
- Configure CSF to block IPs that break these rules
- Optional: Install CSF Modsec Controll - This allows you to switch the rule sets on and off on a per account basis.
I run a number of Wordpress sites and the combination of CSF + Mod_sec + GotRoot rules is a life saver.
Agreed. I already have Mod Sec and the GotRoot rules installed. While this does help, it does not prevent a brute force attack on a customers wordpress site (specifically wp-admin.php) So the same IP address is constatnly hitting hXXp://www.somesite.tld/wp-admin over and over again trying to brute force it's way in. (it's a script do doubt from a compromised computer).
Was just wondering if the logs can be monitored so that if the same IP hits that site/url 100 times or more in 5 minutes that it is blocked.
Agreed. I already have Mod Sec and the GotRoot rules installed. While this does help, it does not prevent a brute force attack on a customers wordpress site (specifically wp-admin.php) So the same IP address is constatnly hitting hXXp://www.somesite.tld/wp-admin over and over again trying to brute force it's way in. (it's a script do doubt from a compromised computer).
Was just wondering if the logs can be monitored so that if the same IP hits that site/url 100 times or more in 5 minutes that it is blocked.
Same problem here, at same date. You're not alone haha!
I'd really appreciate to get a magical setting I could put in CSF to get rid of it -.-
I tried CT_LIMIT at 300 with no luck, it just blocked an actuel customer....