I have vsftp running on a spare computer just for learning and testing. Is there any way to stop people from hammering my system with (I believe they're called) dictionary attacks? I'm in no way a network security guru and there is nothing important on this server, but it's just annoying and wasting my bandwidth.

/var/log/messages:

Mar 17 13:33:13 jackson vsftpd(pam_unix)[23884]: check pass; user unknown
Mar 17 13:33:13 jackson vsftpd(pam_unix)[23884]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=211.43.63.2
Mar 17 13:33:16 jackson vsftpd(pam_unix)[23884]: check pass; user unknown
Mar 17 13:33:16 jackson vsftpd(pam_unix)[23884]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=211.43.63.2
Mar 17 13:33:19 jackson vsftpd(pam_unix)[23884]: check pass; user unknown
Mar 17 13:33:19 jackson vsftpd(pam_unix)[23884]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=211.43.63.2

on and on....different IP's from all over.

(btw, 211.43.63.2 is the "Dongeui Technical High School". Just a kid screwing around I guess.)

Sorry if this is a easy fix. Like I said it's for learning.
Thx,
Exo

You could put it inside your home network or if the same computer is working as a router for your network you can specify listen_address in vsftpd config file so it will only answer to connections from within your network. Read vsftpd.conf manpage for more info about listen_address

Thx Aperculum.
I don't have it acting as a router. I have ftp ports opened up on a hardware router forwarded to this machine. I like having the ftp accessible from the internet also. What if I ran vsftp on a different port? Would the scans still find the ftp if I ran it higher up? Would that negatively affect performance? I'm pretty much the only one who accesses this server.

Reading about how some people are getting hammered on their ssh ports makes me think that there is no easy fix for this either. I guess I'd have to have a script that bans (in real-time) IP's that try to log in more than X times in X minutes:seconds. Or (like I've been doing), shut down ftp when I notice it, and start it a short time later.

Thx,
Exo

You could modify sshblack (http://www.pettingers.org/code/sshblack.html) to scan your vsftp logs and blacklist repeated failed login attempts. It's more of a sticky honeypot, actually, since it frees ip addresses after a pre-specified time.

It requires perl and iptables. Seems to work pretty well.

Garry

Thx major.tom,
This is pretty much the banning script I was talking about. Thx for the link. I'll check into it.
Exo