How to deal with someone trying to login as admin?

Question

During these last days, I noticed in my dblog, that someone has been trying to sneak around.

The person tried finding the login url (my website isn't open for user registration) so they tried everything from my-domain.com/admin, my-domain.com/administrator.. and also my-domain.com/wp-login (which indicates that the person isn't familiar with drupal..)

Once the person ended up on /user he or she tried to login as admin by trying different usernames : admin, administrator etc... (I never use 'admin' as a username for the root user)

is there a way to prevent/protect a drupal website from this sort of things ?

Thanks

ps : i'm interested in how to do this both for d6 and d7.

Answer 1

These kinds of probes are very common across the internet. There are a few things you can potentially do to block this problem and reduce the success of an attacker.

First, I recommend everyone use Two Factor Authentication so that even if the attacker guesses your username and password they still can't login. There was a bounty for $500 to break TFA and although the white-hat attackers had username and password they couldn't break in.

The security review module or Droptor can help monitor these failed logins. If they happen a lot then you need to start taking more actions. Brute force attacks on passwords only work if someone does them a lot so if it just happens a few dozen times I wouldn't worry.

You can track the IP address in use by this person using watchdog entries and then use the built-in D6 Access Rules (or the d7 equivalent - http://drupal.org/project/user_restrictions ) to block access via that IP. You could also deny access to the IP in Apache or some other server level firewall. The firewall/webserver is a more efficient place to block the users in terms of load on the server, but it usually requires a bit more effort.

For Drupal 6 and 7, AjitS has provided an answer with a good description of how to use a rate-limiting feature to prevent repeated login attempts from the same IP.

Answer 2

For Drupal 6 you should check for the Login Security module.

Login Security module improves the security options in the login operation of a Drupal site. By default, Drupal introduces only basic access control denying IP access to the full content of the site.

With Login Security module, a site administrator may protect and restrict access by adding access control features to the login forms (default login form in /user and the block called "login form block"). Enabling this module, a site administrator may limit the number of invalid login attempts before blocking accounts, or denying access by IP address, temporarily or permanently. A set of notifications may help the site administrator to know when something is happening with the login form of their site: password and account guessing, bruteforce login attempts or just unexpected behaviour with the login operation.

For Drupal 7, as @saadlulu said that there's already a feature of locking the access after 5 unsuccessful attempts to login. If you want more control, you could try the Flood Control module.

This project is intended to add an administration interface for hidden flood control variables in Drupal 7, like the login attempt limiters and any future hidden variables.

Answer 3

Perhaps using rename admin paths would help?

The purpose of this module is to secure drupal backend by overriding admin path.

Answer 4

I'd want to handle this in the same way that failed logins from other sources (e.g. ssh, ftp) are handled, so they are all dealt with consistently. For that I'd be looking at fail2ban, which I've had great success using against brute force SSH logins. It also feeds in nicely to monitoring tools, and blocks at the firewall level, which is generally more secure than preventing just Drupal logins because it's common for multiple attack vectors to come from the same place, for example if they're running things like metasploit.

Answer 5

This is actually totally expected behavior. Whenever you publish a website on a public ip, within hours / days you will start getting traffic of the sort. 99.99% of the time, these are just bots that run a generic script looking for unpatched applications or easy passwords. This explains why you see hits on domain.com/wp-login, the (automated) attacking host does not even know initially you are running Drupal, it is trying all the paths of the popular CMS's , Wordpress, Drupal, etc ....

I say don't waste too much time worrying about this. Whatever you do you will always find these scripts scraping your site ... from all over the world.

Two simple things will make your app relatively secure:

1. Serve login and admin pages via https

2. Have a decent password for admin

Whatever security scheme you implement, ALWAYS have a recent backup of your stuff.

Good-luck, happy new-year friend.

Answer 6

What are you asking for is not logical if you mean removing or preventing access to /user page.

If you manage somehow to prevent that page, how are you going to access it?

Plus Drupal already provides a way to stop such attacks by locking access to a user after 5 attempts.

You can limit the attempts to your admin account though.