My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and when I checked the last 3 hours worth, only two were are actually repeated. It's not much of a security issue since those are not the usernames we use for admins but it's kind of annoying that it's filling up our logs. What modules/options are available?
You can use Rename Admin Paths module to override the admin path.
This module allows you to:
rename path like '/admin/...' to '/something/...' rename path like '/user/..' to '/something else/..'
It can be effective against registration spam bots or malicious people.
And using the Login Security module you can
- limit the number of invalid login attempts before blocking accounts,
- or deny access by IP address, temporarily or permanently.
A set of notifications by email or Nagios may help the site administrator to know when something is happening with the login form of their site:
- password and account guessing,
- bruteforce login attempts or just unexpected behaviour with the login operation.
For alternative controls, Login Security can disable Drupal core's login error messages, obfuscating the reason for the login failure. This could make it harder for an attacker to discover whether the account even exists.
The use of the Flood control module is another option to control variables like the login attempt limiters and any future hidden variables.