How to counteract brute force on VPS

I want to share the experience
then i remember to replace the VPS password
the password is 123456
VPS unfortunately i was hit Suspend
how is not subject to suspension
watch as the graph in picture, someone use the vps for DDOS
after I read google, there are software name Denyhosts,
The usefulness of an IP block people trying to access our servers.
How To Install :

1. Update the reposiroty
Centos 5
wget http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
wget http://rpms.famillecollet.com/enterprise/remi-release-5.rpm
sudo rpm -Uvh remi-release-5*.rpm epel-release-5*.rpm

Centos 6
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
sudo rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm

2. Update Yum
Yum -y update

3. Install Denyhosts
yum -y install denyhosts


4. Edit Config file
nano /etc/denyhosts.conf

Note that you need to add to this line
SECURE_LOG = /var/log/auth.log ← What OS you use

BLOCK_SERVICE : sshd ← Service list

DENY_THRESHOLD_INVALID 3 ← it means if someone 3 time invalid password, will block the ip

ADMIN_EMAIL = user@alamat.email ← denyhost will send the log to your mail

5. Restart the service
Service denyhosts restart

if you want see the log, you can open this file /etc/hosts.deny

Previous
Next Post »