DB log message: login failed for user xxx

Question

Does anyone ever get "Login failed by user xxx" messages in their recent log entries? I have been getting the same message over and over for the past several days, always from the same IP address and user trying to access node/add. It's kind of freaking me out. Anything to be done about it?

Answer 1

That means some spam robots trying to access your add form. But since only logged in user can post content, this wont be a big problem. But make sure every permission is okay and also use captcha module to secure forms.

Also use strong passwords for all users

Answer 2

These are often spammers, but might also be malicious users who are trying to break into your site (for example, to use it to post malware, distribute files, or as an email relay). If your set of users is small and well known then you should only be worried about these messages if they are for actual accounts on your site - that would be an indication of a brute force attack.

If your site is Drupal 7 then you already have some built in protection against brute force.

Some modules that might be useful to improve the overall login security of your site.

• http://drupal.org/project/user_restrictions
• http://drupal.org/project/password_policy
• http://drupal.org/project/mollom - configured to show a captcha on the login page
• http://drupal.org/project/tfa
• http://drupal.org/project/ga_login
• http://groups.drupal.org/node/235938

Answer 3

You can also use Restrict IP module to restrict the IP from which the node/add was visited.

Here's an excerpt from module's project page:

... allows administrators to restrict access to the site to an administrator defined set of IP addresses. Anyone trying to access the site from an IP address not in the list of allowed IP addresses will be redirected to an access denied page with the message "Your address is not in the list of allowed IP addresses". No blocks will be rendered, and no javascript will be added to the page. This will happen for any and all pages these users try to access.