Looking at the site log, I found, that somebody with IP address: 91.236.74.135 is methodically sending requests to the page: /user?destination=node/add of my Drupal website. He does it once in every hour. It's definitely a bot. I think, he's trying to brute force the password. For now I banned him in .htaccess with
deny from 91.236.74.135
Can anybody give an advice, how to protect the site from brute force attacks on logins?
I have two ideas to help with this problem.
There are tools and services you can use to look for brute force attacks. The security review module and droptor tools both look in your watchdog (at Administer > Reports > Recent log messages) to see if you have a lot of failed logins for one user. You can also do that manually.
In Drupal 7 the "access rules" feature was removed from core but moved to a contributed module - User Restrictions. Using that module you can block users from a specific IP address. Apache deny rules will be slightly faster if you have relatively small number of rules but the Drupal rules are easier to add/update/remove.
Check into fail2ban (http://www.fail2ban.org/wiki/index.php/Main_Page) if you have access to the server. It will let you put limits on how often someone can bang on the front door before you get blocked (temporarily or permanently).
E.g. from the website:
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email, or ejecting CD-ROM tray) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, curier, ssh, etc).
Also, check out the Login Security module.
Login Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.
With Login Security module, a site administrator may protect and restrict access by adding access control features to the login forms (default login form in /user and the block called "login form block"). Enabling this module, a site administrator may limit the number of invalid login attempts before blocking accounts, or denying access by IP address, temporarily or permanently.
I don't think there's a good way to do it within Drupal.
You should look at configuring your web server and/or firewall settings to enforce request limits.
