I updated my server yesterday to a new version of CentoOS including a new version of DirectAdmin panel. This new installation comes with Brute Force Monitor service.As far as I see, this BFM protects brute force tries. In just 24h of this new server, I see that my 5 sites had 10,000 brute force tries. Basically I see creatures from mud, scum, trying to use my mail server (dovecot) to send emails and also attacks to gain access through ssh. Apparently these attacks are failing.My questions are:Are these attacks really failing?What kind of protection is given by this BFM service? I ask this because I see some entries on BFM log reporting 4265 tries of the same IP? How is this allowed, isn't reasonable for BFM to ban that IP after 3 or 5 wrong tries?Should I be worried?
How secure my server is... Should I worry?
ssh
BFM only blocks addresses which try to brute force DirectAdmin itself; for other services it only notifies you.If you want something which will actually block addresses which attempt to brute force other services, try fail2ban.