How to install BFD (Brute Force Detection)

What is BFD (Brute Force Detection)?
BFD is a modular shell script for parsing applicable logs and checking for authentication failures. There is not much complexity or detail to BFD yet and likewise it is very straight-forward in its installation, configuration and usage. The reason behind BFD is very simple; the fact there is little to no authentication and brute force auditing programs in the linux community that work in conjunction with a firewall or real-time facility to place bans. BFD is available at: R-fx Networks || Linux Software & Blog

This guide will show you how to install and configure BFD to protect your system from brute force hack attempts.

Requirements:
- You MUST have APF Firewall Installed before installing BFD - it works with APF and requires some APF files to operate.
- Root SSH access to your server

Lets begin!
Login to your server through SSH and su to the root user.

 
1. cd /root/downloads or another temporary folder where you store your files.

2. wget http://www.rfxnetworks.com/downloads/bfd-current.tar.gz

3. tar -xvzf bfd-current.tar.gz

4. cd bfd-0.2
5. Run the install file: ./install.sh
You will receive a message saying it has been installed

.: BFD installed
Install path: /usr/local/bfd
Config path: /usr/local/bfd/conf.bfd
Executable path: /usr/local/sbin/bfd

6. Lets edit the configuration file: pico /usr/local/bfd/conf.bfd

7. Enable brute force hack attempt alerts:
Find: ALERT_USR="0" CHANGE TO: ALERT_USR="1"

Find: EMAIL_USR="root" CHANGE TO: EMAIL_USR="[email protected]"


Save the changes: Ctrl+X then Y

8. Prevent locking yourself out!
 
pico -w /usr/local/bfd/ignore.hosts and add your own trusted IPs
Eg: 192.168.1.1
Save the changes: Ctrl+X then Y

BFD uses APF' cli insert feature
and as such will override any allow_hosts.rules entries users have in-place.
So be sure to add your trusted ip addresses to the ignore file to prevent
locking yourself out.

9. Run the program!
 
/usr/local/sbin/bfd -s
  • install, dedicated server, Brute Force Detection
  • 599 brukere syntes dette svaret var til hjelp
Var dette svaret til hjelp?

Relaterte artikler

Options for protecting SSH on Dedicated Servers

Filter by IP - We can set up a firewall to filter SSH access to the SSH port by IP. Change SSH...

E-mail Alert on Root SSH Login

Want to be notified instantly when someone logs into your server as root? No problem, check out...

install mod_security for Apache

What is mod_security? ModSecurity is an open source intrusion detection and prevention engine for...

Installing and Configuring CSF Firewall

This article demonstrates how to install and configure the CSF (configserver) firewall. CSF can...