Resolved block IP address - best place

[Richard Follett]

please see screen shot

Screenshot

is this the best and correct way to block an ip address?

see lots of this error:

82.223.8.191 [2017-03-24 21:36:41] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:43] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:46] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:48] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:50] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:53] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:55] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')

 

[UFHH01]

Hi Richard Follett,

I would recommend to use Fail2Ban with the jail "plesk-panel", but you can certainly as well use the "IP access restriction" method.

 

[Richard Follett]

Thank you - have I got the correct settings? - "Allowed, excluding the networks in the list" set on and then add all the bad IP addresses?

 

[UFHH01]

Hi Richard Follett,

have I got the correct settings?

Yes.

But again: I really recommend to use Fail2Ban, because this will ( automatically ) put a ban into your firewall, making it impossible for the intruder IP to reach the port(s), which is more effective and less time consuming, than ( manual ) adding IP(s) over the Plesk Control Panel to your Plesk-webserver - configuration file.

 

[Richard Follett]

Ok I just installed Fail2ban..

Screenshot

What basic settings should I configure?

no expert so please be gentle...

 

[UFHH01]

Hi Richard Follett,

pls. click on "Trusted IP addresses" and insert

127.0.0.1/8

AND

XXX.XXX.XXX.XXX
( where "XXX.XXX.XXX.XXX" is a placeholder for each server IP(s) )​

Afterwars, click on "Settings" and enable Fail2Ban.


Pls. consider to read the official Plesk 12.5 documentation, if you need further informations/help, how to use Fail2Ban:

=> Protection Against Brute Force Attacks (Fail2Ban)​

 

[Richard Follett]

Thank you for your help.. When you say xxx.xxx.xxx - do I put my computer IP address in there OR the IP address of my server? sorry for my lack of knowledge, just want to get it right...

 

[Richard Follett]

here is plesk-panel code

Screenshot

Screenshot

plesk-wordpress too

 

[UFHH01]

Hi Richard Follett,

When you say xxx.xxx.xxx - do I put my computer IP address in there OR the IP address of my server?

Pls. consider to read the WHOLE suggestion:

pls. click on "Trusted IP addresses" and insert

127.0.0.1/8

AND

XXX.XXX.XXX.XXX
( where "XXX.XXX.XXX.XXX" is a placeholder for each server IP(s) )

I'm a bit lost, what to answer to the next post from you:

here is plesk-panel code

Screenshot

Screenshot

plesk-wordpress too

Would you mind telling us, WHERE you have issues/errors/problems?

 

[Richard Follett]

Originally I logged this call due to the error messages I am seeing in the log like this:

82.223.8.191 [2017-03-24 21:36:41] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:43] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')
82.223.8.191 [2017-03-24 21:36:46] 'CP User Login Attempt Failed' ('Client GUID': '2534f168-a20b-41c2-b753-2bf7ad6dc7b9' => '', 'Login Name': 'admin' => '')

So I wanted to implement best solution..

I apprciate your help and I am sorry but i am a novice at plesk.

The screen shots are showing what I have added .. I have also enabled the Fail2ban flag.

So if my plesk server address is 521.90.115.194 then I just add this to the list ? - 127.0.0.1/8 is already added..

thanks

 

[UFHH01]

Hi Richard Follett,

So if my plesk server address is 521.90.115.194 then I just add this to the list ?

Correct.

I apprciate your help and I am sorry but i am a novice at plesk.

This absolutely no problem, but we still NEED your understanding, when you use Plesk and it's components. The standart configuration/jail/filter - files are the very same for each user on the depending operating system.