What is Brute Force Attack? How to stop it? Brute Force Attack is a very common method that a simple script used to crack the password. They will have automated tools that will try to guess random username and password until it find the right one. Once the password is hacked, the hackers could do any possible damage to your data stored on the web server. They’s essentially forcing their way to user only authorized area’s of a system such as FTP accounts, email accounts, databases, scripts based administrative areas and root or shell access are most common attempts.
For example, if you create an Eukhost hosting account yourdomain.com on the server, it creates a username with 8 characters by default, which is yourdomain.com. So this is the default cPanel format which is used for all. This makes easy to know the username. Then the brute force is made on the passwords, which makes it easy for them to get into the account. Most of the web hosting providers are not recommend us to use the default FTP access which is same as cPanel login details. Sometimes they do changes your htaccess file and make some horrible changes to cause real damage to your business. You cannot stop such attacks by limiting the number of attempts made by an IP address or by banning the IP address.
You can easily spot a brute force attempt by checking your servers log files. You’ll see a series of failed login attempts for the service they’re trying to break into. i.e. # pico /var/log/secure or # tail -f/var/log/secure. Check for failed login attempts such as: Apr 11 19:02:10 fox proftpd[6950]: yourserver (usersip[usersip]) – USER theusername (Login failed): Incorrect password.
In order to stop such brute force attacks is to disable the default FTP access to the server and clients who requires and FTP access, you can create new ftp accounts from your cPanel for them. So that they can easily create new FTP account for their domains from their cPanel > FTP Accounts > Add FTP Account. When default FTP access is disabled, yourdomain.com username is disabled and it does not allows you to add yourdomain.com on the same account. Now, when you create a new account, it can be something like mac@yourdomain.com OR admin@yourdomain.com which makes it difficult for them to enter any account. You also can do this by opening a ticket on Eukhost hosting support desk and Eukhost support department will do the rest.
For more information, click here and go to Eukhost web hosting website
