Add to Favourites Add to Favourites    Print this Article Print this Article

I trust my brute force attack blocking system, I don't need to see all of the BFM messages.

Anyone running a webserver with DirectAdmin at some point will likely see messages like this in thier Message System:

Brute-Force Attack detected in service log from IP(s) 1.2.3.4

meaning, that IP has repeatedly tried to login to their system with an incorrect password, a Brute Force Attack.

All servers should be running some sort of firewall to prevent them, eg:
http://help.directadmin.com/item.php?id=527

The purpose of this guide is to hide those Message System messages once you've established that your blocking system is working correctly.
There are several options and levels to suppress the messages.

1) To suppress all messages and E-Mails entirely (you won't be told about these attacks), while DA will still monitor and call the block_ip.sh (if present):
http://www.directadmin.com/features.php?id=1332


2) If you want to hide the messages from the "Message System", but continue to be notified via E-Mail:
http://www.directadmin.com/features.php?id=1441


3) If you want to send the high-volume attack E-Mails to some different address, like attacks@domain.com, you can add a user.conf variable:
http://www.directadmin.com/features.php?id=1558
eg:

alternate_email=attacks@domain.com



Was this answer helpful?

Also Read