How to Respond to an Active SSH Brute‑Force Attack on WHM

Running a WHM/cPanel server in India puts you in charge of protecting many websites, databases, and email accounts. A frequent threat is an SSH brute‑force attack, where bots try thousands of username/password pairs to gain shell access. If the attack succeeds, the attacker can compromise the server, steal data, or use it for further attacks.

1. Detecting the Attack

Confirm an attack before taking action.

• Review the authentication log. Look for repeated “Failed password” entries from the same IP or many distinct IPs.
• Use WHM’s Security Center. The “Security Advisor” and “SSH Access” tabs highlight suspicious activity.
• Leverage fail2ban (if installed). It automatically bans IPs after a configurable number of failures.

Example command to view recent SSH failures (run as root):

# Debian/Ubuntu
grep "Failed password" /var/log/auth.log | tail -n 20

# AlmaLinux/RHEL
grep "Failed password" /var/log/secure | tail -n 20

2. Immediate Containment

Block the offending IP(s) at the firewall level. WHM servers normally use csf (ConfigServer Security & Firewall) or the built‑in iptables rules.

Using CSF (recommended for WHM)

1. Log in to WHM → Plugins → ConfigServer Security & Firewall.
2. In the “Quick Allow/Deny” box, enter the malicious IP and click Deny.

From the command line:

/usr/sbin/csf -d 203.0.113.45 "SSH brute‑force"

This command denies the IP 203.0.113.45 and records a comment for future reference.

Using iptables directly (if CSF is not installed)

For AlmaLinux/RHEL systems:

iptables -A INPUT -p tcp --dport 22 -s 203.0.113.45 -j DROP
service iptables save

• -A INPUT – append a rule to the INPUT chain.
• -p tcp --dport 22 – match TCP traffic to port 22 (SSH).
• -s 203.0.113.45 – source IP to block.
• -j DROP – silently discard matching packets.
• service iptables save – persist the rule across reboots.

For Debian/Ubuntu systems using ufw (the default uncomplicated firewall):

ufw deny from 203.0.113.45 to any port 22

3. Strengthening SSH Configuration

After containment, harden SSH to reduce future risk.

Disable password authentication

Switch to key‑based authentication only. Edit /etc/ssh/sshd_config and add:

PasswordAuthentication no
PubkeyAuthentication yes

Restart the SSH daemon:

• AlmaLinux/RHEL: systemctl restart sshd
• Debian/Ubuntu: systemctl restart ssh

Change the default port

Move SSH off port 22 to reduce automated scans. In sshd_config, locate the line:

#Port 22

Uncomment and change it, e.g., to 2222:

Port 2222

After saving, restart the daemon and update firewall rules accordingly.

Limit login attempts per connection

Add or modify these directives in sshd_config:

MaxAuthTries 3
MaxSessions 2

These limits reduce the number of guesses an attacker can make before the connection is closed.

4. Deploying Automated Protection (fail2ban)

If fail2ban is not installed, set it up now. It watches log files and bans IPs that exceed a threshold.

Installation

• AlmaLinux/RHEL (dnf):

dnf install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

• Debian/Ubuntu (apt):

apt update
apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

Configuration for SSH

Create a local jail override to avoid editing the default file:

cat > /etc/fail2ban/jail.d/ssh.conf <

logpath = /var/log/auth.log

systemctl restart fail2ban