4

My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and when I checked the last 3 hours worth, only two were are actually repeated. It's not much of a security issue since those are not the usernames we use for admins but it's kind of annoying that it's filling up our logs. What modules/options are available?

  • finally, do you solve the problem? – Adrian Cid Almaguer Feb 10 '16 at 7:15
  • Yes, I just created a new module to do a certain validation – Robert Lee Feb 16 '16 at 22:07
  • can you post the answer? – Adrian Cid Almaguer Feb 16 '16 at 22:12
  • Simply suspended non-whitelisted IPs trying to log in with blacklisted usernames. – Robert Lee Feb 17 '16 at 22:18
3

You can use Rename Admin Paths module to override the admin path.

This module allows you to:

rename path like '/admin/...' to '/something/...'
rename path like '/user/..' to '/something else/..'

It can be effective against registration spam bots or malicious people.

And using the Login Security module you can

  • limit the number of invalid login attempts before blocking accounts,
  • or deny access by IP address, temporarily or permanently.

A set of notifications by email or Nagios may help the site administrator to know when something is happening with the login form of their site:

  • password and account guessing,
  • bruteforce login attempts or just unexpected behaviour with the login operation.

For alternative controls, Login Security can disable Drupal core's login error messages, obfuscating the reason for the login failure. This could make it harder for an attacker to discover whether the account even exists.

The use of the Flood control module is another option to control variables like the login attempt limiters and any future hidden variables.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.