My server is under attack

[crusher11 1255]

No idea how they're getting to it, as it's a Hong Kong IP address and CloudFlare is blocking traffic from outside Australia. Three failed login attempts in the past ten minutes, one trying to log in as “root.” I see the alerts on my dashboard, but what I don't see is any way to block the offending IP? Not sure what autoban conditions exist, but since I'm on my server machine right now it seems silly to wait for it to kick in when I could just push a button. Is there no way to do that? And if it does get autobanned, I assume that's only for a period of time.

Not sure what other steps I should be taking here.

EDIT: I've disabled all remote connections for now, but it's obviously not the best solution.

EDIT 2: It's not a solution at all, it seems, as even with remote connections disabled I've just had another two failed login attempts, this time from Kansas City (the US is also on my CloudFlare whitelist, so that at least makes more sense than the Hong Kong efforts, though how it's connecting with all remote connections disallowed I don't know).

Edited Thursday at 06:57 PM by crusher11

[Lessaj 545]

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

[crusher11 1255]

Just now, Lessaj said:

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

Not sure if you saw my second edit, as you posted only a few seconds after I made it.

Which settings page is this screenshot from?

[Lessaj 545]

I did not. That's on the Network page.

[crusher11 1255]

Ah, right, I couldn't see it because it disappears if you disable all remote connections.

There really ought to be a way to add an address directly to that list from the “failed login attempt” alert.

Still no idea how they bypassed the CloudFlare block, or how they connected when all remote connections were disabled in Emby, or why I've suddenly had a bunch of attacks come in.

[Lessaj 545]

Based on my understanding the option for allow remote connections doesn't prevent the connection entirely, it just prevents logins. If the port is open, then it's open. You'd have to close the port/Cloudflare tunnel to fully disable remote connections. I can't test on my system at the moment to confirm that.

[RanmaCanada 573]

If you're only Cloudflare, does it not have an option to whiltelist traffic, and block everything else? I honestly do not know as I do not use it.

apparently there is. https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/

[pwhodges 2083]

Do you not have a firewall in your own equipment?

Paul

[crusher11 1255]

7 hours ago, pwhodges said:

Do you not have a firewall in your own equipment?

I would assume so? I'm not sure which equipment would be involved here; my NAS isn't on the internet directly as far as I know.

[pwhodges 2083]

I have no experience of NASes, but I would assume that they would have at least some firewall capabilities available, as virtually all operating systems do.  In my case, my main firewall is in my router - but that is of a type aimed at SMEs rather than domestic use (the simpler domestic routers may simply rely on IPv4 NAT for security, though that's not good enough if you have IPv6).

Paul

[crusher11 1255]

I have all the online functionality of my NAS's operating system disabled, so I'm not sure how it all works. Would the NAS firewall see anyone connecting to Emby?

And regardless, how does it impact this specific situation?

[TMCsw 290]

Do you have a port open on your router, either manually or by allowing UPnP? If so, anyone(hackers) can directly hit your LAN, without going thru CF.

[crusher11 1255]

You have to have a port open for the domain to work, no?

[Neminem 1832]

Hmm so you just port forward to Emby via your router?

If the above is correct then this is correct.

20 hours ago, TMCsw said:

If so, anyone(hackers) can directly hit your LAN, without going thru CF.

Have you setup fail2ban or other have a prober firewall?

I use a local firewall and have geo blocking inplace.

You wont believe how many bots / script kiddies / other that hit my firewall everyday.

Edited 56 minutes ago by Neminem

[crusher11 1255]

Just now, Neminem said:

Hmm so you just port forward to Emby via your router?

It's been a long time since I set it up so I've forgotten a lot of the config, but I have NGINX involved somewhere. I'm not sure where the ports forward to, that always confused me a bit TBH.

1 minute ago, Neminem said:

Have you setup fail2ban or other have a prober firewall?

My understanding is Emby now implements IP blocking after a certain number of failed attempts. I think I had fail2ban set up when I was running the server on my Windows machine but could never figure out how to set up something like that on Synology, then once Emby implemented it anyway I forgot about it.

[Neminem 1832]

CF should not be you only security.

6 minutes ago, crusher11 said:

My understanding is Emby now implements IP blocking after a certain number of failed attempts.

That might not be tight enough.

Hence your own firewall that can take the blows.

[crusher11 1255]

Just now, Neminem said:

CF should not be you only security.

That might not be tight enough.

Hence your own firewall that can take the blows.

As I said to @pwhodges, is the Synology OS going to see attacks on Emby?

Is there a way to block direct connections to my IP? I was under the impression that the CF/NGINX setup I followed was supposed to do that.

[Neminem 1832]

4 minutes ago, crusher11 said:

Is there a way to block direct connections to my IP? I was under the impression that the CF/NGINX setup I followed was supposed to do that.

Yes, turn of port forwarding.

But then you can't do remote sessions.

Unless you setup a VPN or the like.

[crusher11 1255]

Right, I want the domain to still work, obviously.

[Neminem 1832]

Then you need a firewall to block, who you don't want to have access.

If they are going in directly to your ip then CF can't help you.