Is ISPConf Admin panel brute force attack safe?

[Bashewa]

Hi Guys

Just want to know is my ISPConfig panel on port 8080 protected from brute force attacks trying to guess username and password?

I dont see any jails for it in fail2ban is it possible to set one up?



Thanks

Alex

[falko]

Originally Posted by Bashewa

I dont see any jails for it in fail2ban is it possible to set one up?

I don't think so because failed login attempts aren't logged anywhere, so fail2ban cannot know about them.

Better use a strong password.

[erosbk]

Ok, is it possible to add log for failed loggins? I already detected attacks to ispconfig in my logs...

[pititis]

Hi,

you can check the attempts_login table in the database.

Cheers

[till]

ISPConfig has its own mecahnism to block brute force attcks builtin (similar to what fail2ban is doing). So there is no need to use fail2ban for ispconfig logins.

[Bashewa]

Is there anyway of adjusting the inbuilt brute force protection?

I.E. number of attempts and length of ban time?

[till]

Not without modifying the code of the login.php script.