Webserver Failed logins

Nate

Nate

Nate

Associate
Joined
18 Oct 2002
Posts
1,581
Location
Nottingham
I get emailed the logs for the webserver at work and everytime i see the server has been 'hammered' with usernames and passwords is this pretty common? The attempts are random names going from a - z and the password as password.

example
aaa : password

through to

zzz : password

With all manner of peoples names in the middle. Just really wondering if this is common or what really.
 
sounds like someone going the long way trying to get access to random emails on your web server. i think that's called a brute force attack, where random usernames are tried, then they'll try every combination of letters and numbers to get the password. it'd put incredible strain on your server though.

can you see where they're coming from? is this an intranet? because if it is, there might be some security issues, if the logins are coming from outside your LAN/WAN
 
as far as i know they are trying to log into the server. they are coming from external ip addresses.
 
It's very common if the server is open to the web. Provided your passwords are secure, it's nothing to worry about.
 
Is it not going to cause a problem on the servers performance if someone is hammering it trying to log in?
 
Not unless you're getting thousands of requests a second or you're running a 486 ;).

I'm assuming this is Linux and SSH?
 
This is a brute force attack. I'd immediatley block the IP doing the job before it brings down your server.

Blacklist any of the IPs involved. See how it goes from there.
 
had a look round the server control panel can find anywhere to add IPs to a blacklist, can i do it via ssh?
 
You must log in or register to reply here.
Back
Top Bottom