#7028 (Too many authentication failures from 103.168.67.253)

by Luc Saffre · in Developers · assigned to Luc Saffre

Summary

Gemini says "To protect your server immediately, you should block this IP address at your firewall and report the malicious activity to the provider. Because brute-force attacks are automated, leaving the port exposed will allow the traffic to continue draining your system resources."

Children

Comments

3 weeks, 3 days ago by Luc Saffre about #7028 (Too many authentication failures from 103.168.67.253) : Gemini suggested different option for doing this. I think that the following suggestion (using Ansible) suits us best: You maintain a single blocked_ips.yml file on your local machine. When an IP needs to be permanently banned, you add it to the file and run an Ansible playbook to roll out the update...
3 weeks, 3 days ago by Luc Saffre about #7028 (Too many authentication failures from 103.168.67.253) : TODO: Shouldn't we install ufw on all our servers and have a centralized list of blocked ip addresses?
3 weeks, 3 days ago by Luc Saffre about #7028 (Too many authentication failures from 103.168.67.253) : The contact form at digivps.com/contact-us/ didn't work, it said "There was an error trying to send your message. Please try again later."
I also sent an email to abuse@digivps.com
3 weeks, 3 days ago by Luc Saffre about #7028 (Too many authentication failures from 103.168.67.253) : I followed Gemini's instructions and installed ufw, then said "sudo ufw deny from 103.168.67.253 to any".
3 weeks, 3 days ago by Luc Saffre about #7028 (Too many authentication failures from 103.168.67.253) : Created new Ticket #7028 (Too many authentication failures from 103.168.67.253).