Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

Looking at the site log, I found, that somebody with IP address: 91.236.74.135 is methodically sending requests to the page: /user?destination=node/add of my Drupal website. He does it once in every hour. It's definitely a bot. I think, he's trying to brute force the password. For now I banned him in .htaccess with

deny from 91.236.74.135

Can anybody give an advice, how to protect the site from brute force attacks on logins?

share|improve this question
    
For Admin login you can allow logging in from single IP only. What are the post request parameters BTW? –  AgA Oct 31 '12 at 3:23
    
> "What are the post request parameters BTW?" They were not saved in the log. –  user4035 Oct 31 '12 at 7:03

4 Answers 4

up vote 13 down vote accepted

I have two ideas to help with this problem.

There are tools and services you can use to look for brute force attacks. The security review module and droptor tools both look in your watchdog (at Administer > Reports > Recent log messages) to see if you have a lot of failed logins for one user. You can also do that manually.

In Drupal 7 the "access rules" feature was removed from core but moved to a contributed module - User Restrictions. Using that module you can block users from a specific IP address. Apache deny rules will be slightly faster if you have relatively small number of rules but the Drupal rules are easier to add/update/remove.

share|improve this answer

Check into fail2ban (http://www.fail2ban.org/wiki/index.php/Main_Page) if you have access to the server. It will let you put limits on how often someone can bang on the front door before you get blocked (temporarily or permanently).

E.g. from the website:

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email, or ejecting CD-ROM tray) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, curier, ssh, etc).

share|improve this answer

Also, check out the Login Security module.

Login Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.

With Login Security module, a site administrator may protect and restrict access by adding access control features to the login forms (default login form in /user and the block called "login form block"). Enabling this module, a site administrator may limit the number of invalid login attempts before blocking accounts, or denying access by IP address, temporarily or permanently.

share|improve this answer

I don't think there's a good way to do it within Drupal.

You should look at configuring your web server and/or firewall settings to enforce request limits.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.