Numerous brute force access attempts on my server, how to solve?

aquilamendes

Dear all, I have noticed in the aapanel logs a series of brute force access attempts that are "luckily" being blocked. How can I resolve this definitively?

Not to mention that I have received alarm emails from aapanel several times a day, like the one below. I await your response.

aaPanel_Kern

Changing the default SSH port is also ideal

aquilamendes

aaP_knjige

I set it up like this:

aquilamendes

aaP_knjige I made these adjustments, let's see if it improves.

aaP_knjige

It's also a good idea to hide your IP address via Cloudflare proxy.

aquilamendes

aaP_knjige How to do this?

aaP_knjige

aaPanel_Kern Yes, correct, let's change port 22 to 135 for example.

aquilamendes

aaPanel_Kern This was already updated, I don't use port 22 as default.

aquilamendes

@aaPanel_Jose @aaPanel_Kern Update: none of the tips given here solved my problem, I still have thousands of brute force login attempts and it seems that the security solutions from aapanel don't solve anything.

I have already blocked all countries except my own for access
Everything active regarding security and brute force
Changed the default port of all services, including SSH access etc etc

I don't know what else to do!

aaPanel_Kern

Hello, if your IP is static, it is recommended that you set the ssh port only for your own IP access.
Are you checking the logs for new blocking information?

aquilamendes

aaPanel_Kern Yes, my IP is static. I have already configured this to block access to SSH from any IP other than my own. However, what I stated in the initial post is a brute force login attempt and it seems that the aapanel is not performing the necessary blocks.

Please see the images I posted above initially.

aaPanel_Kern

Hello, this is the blockade log, and the conditions are met and blocked. It means it works properly

aquilamendes