My server is under attack

[crusher11 1255]

No idea how they're getting to it, as it's a Hong Kong IP address and CloudFlare is blocking traffic from outside Australia. Three failed login attempts in the past ten minutes, one trying to log in as “root.” I see the alerts on my dashboard, but what I don't see is any way to block the offending IP? Not sure what autoban conditions exist, but since I'm on my server machine right now it seems silly to wait for it to kick in when I could just push a button. Is there no way to do that? And if it does get autobanned, I assume that's only for a period of time.

Not sure what other steps I should be taking here.

EDIT: I've disabled all remote connections for now, but it's obviously not the best solution.

EDIT 2: It's not a solution at all, it seems, as even with remote connections disabled I've just had another two failed login attempts, this time from Kansas City (the US is also on my CloudFlare whitelist, so that at least makes more sense than the Hong Kong efforts, though how it's connecting with all remote connections disallowed I don't know).

Edited Thursday at 06:57 PM by crusher11

[Lessaj 545]

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

[crusher11 1255]

Just now, Lessaj said:

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

Not sure if you saw my second edit, as you posted only a few seconds after I made it.

Which settings page is this screenshot from?

[Lessaj 545]

I did not. That's on the Network page.

[crusher11 1255]

Ah, right, I couldn't see it because it disappears if you disable all remote connections.

There really ought to be a way to add an address directly to that list from the “failed login attempt” alert.

Still no idea how they bypassed the CloudFlare block, or how they connected when all remote connections were disabled in Emby, or why I've suddenly had a bunch of attacks come in.

[Lessaj 545]

Based on my understanding the option for allow remote connections doesn't prevent the connection entirely, it just prevents logins. If the port is open, then it's open. You'd have to close the port/Cloudflare tunnel to fully disable remote connections. I can't test on my system at the moment to confirm that.

[RanmaCanada 573]

If you're only Cloudflare, does it not have an option to whiltelist traffic, and block everything else? I honestly do not know as I do not use it.

apparently there is. https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/

[pwhodges 2083]

Do you not have a firewall in your own equipment?

Paul

[crusher11 1255]

7 hours ago, pwhodges said:

Do you not have a firewall in your own equipment?

I would assume so? I'm not sure which equipment would be involved here; my NAS isn't on the internet directly as far as I know.

[pwhodges 2083]

I have no experience of NASes, but I would assume that they would have at least some firewall capabilities available, as virtually all operating systems do.  In my case, my main firewall is in my router - but that is of a type aimed at SMEs rather than domestic use (the simpler domestic routers may simply rely on IPv4 NAT for security, though that's not good enough if you have IPv6).

Paul

[crusher11 1255]

I have all the online functionality of my NAS's operating system disabled, so I'm not sure how it all works. Would the NAS firewall see anyone connecting to Emby?

And regardless, how does it impact this specific situation?