Brute Force Attack?

[webcanada]

Hi all,

I'm being told that my Plesk server is currently under a "brute force attack", which I understand is where someone tries to hack in by trying every password combination. Evidently this has been going on for a few days, but I didn't know what it was until last night.

My ISP says they are trying to block the IPs that are doing this, but my questions are:

- what are they trying to hack into? SSH/root? FTP? Plesk CP?
- what can be done to better defend against this?

Thanks!

 

[dynamicnet]

Greetings:

Without more information, it could be any protocol – SSH, FTP, POP3, IMAP, etc.

I do recommend you secure your server; and such security should include a level of brute force protection.

Thank you.

 

[webcanada]

Hi dynamicnet,

Can you offer any suggestions for how to troubleshoot this within Plesk CP? I can't SSH into the box, because of this. My hosting company, Hostway, is being super slow to respond with help. It's been days. I'm trying turning various things on/off in the Firewall module.

Other than not being able to connect by FTP or SSH, the server itself doesnt seem to be slow.

I've disabled SSH, FTP, and denied all other incoming traffic, but my average load still seems to be climbing.

Thanks

 

[webcanada]

OK, my average load is out of control:

Average load 360.17; 354.62; 340.06

Hostway, my ISP, is totally NOT helping ... (anyone else use Hostway??? SHEESH!)

Can anyone offer any suggsetions? I can't SSH. I tried turning off various Firewall items in the Firewall module, pretty much everything except SMTP/POP/Web/Plesk admin interface/MySQL.

How can you tell what port you're being attacked on??

Thanks.

 

[dynamicnet]

Greetings:

Without SSH access it is hard to diagnose for both you and those trying to help you.

I recommend calling them on the phone to find out the following:

1. What type of brute force?

2. What is causing the current load?

3. What is the current # of processes running?

4. What is the current mail queue size?

What % of the size is incoming email? What % of the size is outgoing email?

5. What is my current bandwidth?

How does that compare to other types?

I.e. is my bandwidth peaking to match the current server load?

If yes, what % is incoming? What % is outgoing?

Thank you.