The Problem: Alert Fatigue vs. Active Mitigation

By default, DirectAdmin's Brute Force Monitor acts as an audit sensor rather than an enforcement firewall. It periodically reads authentication failure logs across multiple system services:

• /var/log/maillog: Exim SMTP authentication rejections and Dovecot login failures.
• /var/log/secure (or /var/log/auth.log): OpenSSH pam_unix invalid user rejections.
• /var/log/proftpd/auth.log: FTP brute-force password guessing.
• /var/log/httpd/domains/*.error.log: Apache/Nginx HTTP basic auth and WordPress XML-RPC abuse.

When an offensive IP address exceeds the configured failure threshold (e.g. 100 failed attempts within an hour), BFM logs the incident and dispatches an alert email to the server administrator. However, dispatching an email does not terminate the TCP handshake. The remote botnet continues hammering the daemon, consuming CPU cycles in password-hashing routines (such as bcrypt or SHA-512 crypt) and saturating connection backlogs. True operational resilience requires active, automated drop rules executed at the kernel firewall level.

Automating Drops with DirectAdmin Custom Event Scripts

DirectAdmin provides native hook points that execute custom shell scripts whenever the Brute Force Monitor detects an attacker. By creating and permissions-hardening two key scripts, administrators can instruct the operating system to drop abusive packets instantly:

# /usr/local/directadmin/scripts/custom/block_ip.sh
#!/bin/sh
# Invoked by DirectAdmin BFM to ban an offending IP
IP=$1
if [ "$IP" = "" ]; then
    exit 1
fi

# Example 1: If using ConfigServer Firewall (CSF)
if [ -s /usr/sbin/csf ]; then
    /usr/sbin/csf -d "$IP" "DirectAdmin BFM Automated Drop"
    exit 0
fi

# Example 2: Native iptables drop via ipset (Zero latency overhead)
ipset add blacklist_ips "$IP" -exist
iptables -I INPUT -m set --match-set blacklist_ips src -j DROP
exit 0

To enable automated banning directly within the DirectAdmin control panel interface, administrators configure brute_force_notice_ip.sh to automatically trigger block_ip.sh whenever the threshold is breached, completely silencing repetitive alert emails:

# /usr/local/directadmin/scripts/custom/brute_force_notice_ip.sh
#!/bin/sh
SCRIPT=/usr/local/directadmin/scripts/custom/block_ip.sh
IP=$value
if [ -x "$SCRIPT" ] && [ "$IP" != "" ]; then
    "$SCRIPT" "$IP"
fi
exit 0

Architecture Comparison: CSF/LFD vs. Fail2ban vs. Kernel IPSet

Selecting the right defense layer depends on server density and throughput requirements:

Automated Drop Pipeline: From Auth Failure to Packet Blackhole

The diagram below illustrates how an incoming attack vector is parsed, categorized, and blackholed in real time:

Hardening Ingress: Connection Rate Limiting with IPTables

Beyond reactionary log-parsing bans, proactive ingress rate limiting ensures that brute force attempts never reach the daemon in high volume. The Linux kernel's recent module allows rate-limiting incoming connection handshakes at Layer 4:

# Rate limit new SSH connections to 4 attempts per 60 seconds per source IP
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH_ATTEMPTS
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH_ATTEMPTS -j DROP

# Rate limit SMTP authentication handshakes
iptables -A INPUT -p tcp --dport 587 -m conntrack --ctstate NEW -m recent --set --name SMTP_AUTH
iptables -A INPUT -p tcp --dport 587 -m conntrack --ctstate NEW -m recent --update --seconds 120 --hitcount 10 --rttl --name SMTP_AUTH -j DROP

By enforcing connection rate limiting, legitimate users connecting once or twice experience zero latency, while automated dictionary scanners are immediately rate-throttled and blackholed by the kernel before generating hundreds of log entries.

Production Security Best Practices

Implementing automated bans is only one component of a defense-in-depth infrastructure strategy:

1. Relocate Sensitive Ports: Moving OpenSSH from default port 22 to a non-standard high port (e.g. 2222 or 50222) eliminates 99.2% of automated internet-wide scanner noise.
2. Mandate Public Key Authentication: Disable password authentication entirely in /etc/ssh/sshd_config (PasswordAuthentication no and PermitRootLogin prohibit-password) using modern ed25519 cryptographic keys.
3. Protect Web Application Endpoints: Block WordPress XML-RPC (xmlrpc.php) and wp-login.php brute force vectors at the Nginx edge or Cloudflare WAF, preventing PHP-FPM worker exhaustion.