Question Huge amount of failed login attempts?

[Colonel36]

Server operating system version

Ubuntu 20.04

Plesk version and microupdate number

Plesk Obsidian18.0.57

I've just noticed in the logs there a huge amount of failed logins from different ip addresses.
I've got Fail2ban active, but what are the most secure settings I should have.

In addition, I have multi factor active.
When I try to change my password to a stronger one, it constantly says it doesn't recognised the old one, even I checked it time and time again and can always login with it?
Thanks in advance.

 

[Kaspar]

I've just noticed in the logs there a huge amount of failed logins from different ip addresses.
I've got Fail2ban active, but what are the most secure settings I should have.

Fail2ban and MFA should be plenty. But if you want you could also consider:

• Limit access to Plesk to your own IP's
  More information can be read here
  This is only really useful if you have an internet connection with a static IP or use VPN with a static IP.
  
  
• Run Plesk on a different port
  More information can be read here
  This does requires a bit technical knowledge to configure.
  
  
• Disable admin access to Plesk for the Root user
  More information can be read here

When I try to change my password to a stronger one, it constantly says it doesn't recognised the old one, even I checked it time and time again and can always login with it?

Do you login as root or as admin to Plesk?
Root is considered an alias of the admin user, however you can only change the password via Plesk fot the admin user, not for root user.

 

[Colonel36]

Thanks.
I didn't know I had an admin user account?
Can you inform me how I could access them?

 

[Kaspar]

Can you inform me how I could access them?

Sure. Connect via SSH or use the SSH terminal in Plesk and run the command Plesk login . This wil generate a temporary login URL for the admin user. After accessing the temporary login URL, you can set (change) a password for the admin user.

 

[Colonel36]

Thanks for the reply.
I have tried to do that, but it won't let me copy the temporary url.
I have tried:
1. Using Keyboard Shortcuts:

• Copy: Press and hold the Shift key, then press Ctrl+C.
• Paste: Press and hold the Shift key, then press Ctrl+V.
  

2. Using Mouse and Context Menu:

• Select: Use your mouse to highlight the text you want to copy.
• Right-click: Right-click on the selected text.
• Copy: Choose the "Copy" option from the context menu.
• Paste: Navigate to the application where you want to paste the text, then right-click and choose "Paste".

But, I'm afraid, I haven't had any luck?

 

[Colonel36]

Forget the last post. I've sorted it out.
The problem, however, still exists. It still won't let me change the password, even with the temporary url login?
I only have one login 'root' and when I try 'admin' that won't work.
I have tried the 'forgotten password,' and entered my email, but no email ever arrives?

 

[Kaspar]

Your are right, my bad. I didn't realize that you still needed the old password to change the password via Plesk.

As an alternative method, you can change the admin password via command line with the following command (change your_new_password to your desired password).

plesk bin admin --set-admin-password -passwd 'your_new_password'

 

[Colonel36]

Thanks.
I had already done that, but it didn't work. It said the change was successful, but when I tried to login, it didn't work?

 

[Kaspar]

Thanks.
I had already done that, but it didn't work. It said the change was successful, but when I tried to login, it didn't work?

Just to be sure, what user name did you try to login with the new password?

 

[Colonel36]

I tried with admin and with root
I'll have another go now and double check

 

[Colonel36]

Wow! It worked this time. Great thanks

 

[Colonel36]

Fail2ban and MFA should be plenty. But if you want you could also consider:

• Limit access to Plesk to your own IP's
  More information can be read here
  This is only really useful if you have an internet connection with a static IP or use VPN with a static IP.
  
  
• Run Plesk on a different port
  More information can be read here
  This does requires a bit technical knowledge to configure.
  
  
• Disable admin access to Plesk for the Root user
  More information can be read here

Do you login as root or as admin to Plesk?
Root is considered an alias of the admin user, however you can only change the password via Plesk fot the admin user, not for root user.

I followed the first instructions: https://support.plesk.com/hc/en-us/...Y*MTc0NTU3MTA5Ni43LjEuMTc0NTU3MTgzNi42MC4wLjA.
but I get this error all the time: Error: The access restriction policy and the list of networks are currently configured the way you will not be able to log in with administrator's rights from your IP address '**.**.**.**'.

 

[Colonel36]

To try to stop these attacks, I'm currently firewalling half the world! But, I fear, this may affect SEO and Google bots?

 

[Kaspar]

Error: The access restriction policy and the list of networks are currently configured the way you will not be able to log in with administrator's rights from your IP address '**.**.**.**'.

This error means that you haven't added the IP address you're currently using and are logged to Plesk on with. The solution is to make sure to add the shown IP address in the error to the list first.

To try to stop these attacks, I'm currently firewalling half the world! But, I fear, this may affect SEO and Google bots?

It could, if you are blocking the Google Crawler servers for example. You have to be some what selective with blocking IP's. A good source to check if IP's are malicious is abuseipdb.com. Generally, there much more bad IP's (and subsnets) then there are legitimate crawlers. So the the chances of blocking Google is pretty slim, but never null.

 

[Colonel36]

Thanks. I did add my address, but it made no difference. It still logged me out, and I had SSH to get back in with code?

 

[Colonel36]

As for using the link, you sent, I would be here for the next 34, 000 days looking them up and adding them?
Thanks for your support, but surely, there must be a very simply way Plesk can sort out these attacks?