password cracking attempt at secure area

[SM777]

I'm experience a bad flood of password cracking attempts. What I usually do is to see the ip address and block it in the .htaccess file.

But this time I'm seeing about 40 or 50 different IP address worldwide hitting on me with random passwords.

Whats the best thing to do now and in the future?

for now I have stopped Apache and hope they'll go away.

In the future I guess I need some tool to block ip addresses dynamically. How's this done?

I have a 404 redirect that brings up a page if an incorrect password is entered whilst trying to access a secure area. Is this not enough?

Doesit not slow the &*^£*^$ers down? would the 404 redirect be better in say redirecting to a non existant site?

Help me out here guys its late and I dont want to stay up all night.

debian. apache 1.3.20

 

[SM777]

Correction: I have a 401 redirect that brings up a page if an incorrect password is..

 

[Wullie]

Hi mate,

You may be able to modify the code on the following page to get it to do what you want..

http://www.planet-source-code.com/vb/scripts/ShowCode.asp?lngWId=6&txtCodeId=314

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[Wullie]

Hi mate,

Is he using multiple connection at he same time?

If so then the following may help...

http://www.snert.com/Software/mod_throttle/

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[SM777]

I think that mod throttle thing may work. Cheers.

I'm still getting hit though. Let me run it by you again.

I have a private area secured by a .htaccess .htpasswd setup.

Chummy is using something like

http://wwwhack

to brute force attempt to find a valid password.

I cant block his IP address because he is spoofing from a pool of hundreds of IP addresses. I cant complain to his ISP for the same reason.

Any other methods apart from converting to PHP?