Bruteforce / Ban not efficiently working

@mattoo64

Ok, so just to clarify this is a user lockout issue.

Is this happening while using the latest iTSec plugin release (5.2.1) ?
The user\account roland actually exists, right ?

Last but not least what is the url of the website ?
Don’t worry, I mean no harm to your website. I just need to check something before I can give you my final verdict.

dwinden

Dear Dwinden,

Thanks for your answer, I do appreciate !!

Yes, I’m using the latest version 5.2.1, I just checked before answering.

Account roland actually exist, although it never posted any message, dunno how the hacker managed to find it, but it actually exist. It happens that it is not an admin, and that its password is VERY strong, fortunately. However, it’s a good exercise to fine tune my iTSec plugin for this (and all my other sites).

The attacked Website URL is : https://www.alice-b-alexander.com/

FYI later in the afternoon (hours after this post)I got a mail this afternoon, AFTER changing to 120 min the “Minutes to Remember Bad Login (check period)” setting :

Dear Site Admin,

A host, 54.191.138.145, and a user, roland, have been locked out of the WordPress site at https://www.alice-b-alexander.com due to too many bad login attempts.

The host has been locked out permanently and the user has been locked out until 2016-02-13 18:14:24.

Checking in the Ban Hosts field of the iTSec Plugin I can confirm the IP is actually locked.

Anyhow, I would be very interested by your answer / comments / advices, especially on the fact to turn the ban to 120 min — is that ok ?

Thanks !!

@mattoo64

Increasing the “Minutes to Remember Bad Login (check period)” setting’s value also increases the risk for false positives.
Basically locking out (and ultimately banning) legit IPs that accidentally enter a wrong password and thus trigger invalid login attempts. You don’t want that …

It’s also a nice example of fighting against symptoms but not really solving the underlying problem. A cure that is possibly worse than the disease …

The real problem is that your website is leaking user\account names.
And these are being used in a brute force attack.
Solve that and there will be no more symptoms like reported in this topic to fight.

Any WordPress environment will leak user\account names if not properly set up. Since ALL your user\account names are already out in the open you will need to remove all of them and create new users\accounts. Also choose user names that are not easy to guess (so not like: alice).

And you need to do so AFTER making sure that the Force Unique Nickname and Disable Extra User Archives settings in the WordPress Tweaks section of the iTSec plugin Settings page are enabled.

Without your website exposing user names hackers/botnets will find your website a lot less interesting for brute force attacks.

Addendum: I forgot something in my initial post.

Enabling the Hide Backend feature and disabling XMLRPC (if possible) will also prevent many automated brute force attacks.

dwinden

Dear Dwinden,

Many thanks once again for your detailed and valuable answers.

basically :
– how can I check if (one of) my website(s) is leaking user\account names or not ?
– what is the best way to make sure it is NOT ?

Although I 100% understand and agree your point about increasing Minutes to Remember Bad Login, do you think setting 120 min could harm the site server (in terms of ressources) ?

A big thanks for all your help,

Matt

@mattoo64

– Google : user enumeration wordpress
– This question is already answered in my previous post.

If you solve the root cause of your issue there is no need to change any default setting value.

dwinden