I am not a prolific blogger – that is pretty clear from the amount of posts on here – but to some IP addresses it is as if I am Stephen Fry or something – one IP address is taking 1GB of my bandwidth this month, so I guess something needs to be done.
As far as spam goes – Akismet is absolutely fantastic and has a 100% track record against it…
For some reason, I get lots of new user registrations which don’t appear to have any interest in the content of my site – which is pretty understandable since it is pretty sparse and boring! I guess that they’re trying to use some sort of wordpress backdoor or something?
My guess is that the large volumes of traffic are attacking the passwords – it is unlikely that they will be able to with a brute force attack because it is a complicated password! But I see similar activity on my home Fedora machine, which has its SSH port open to the internet through the firewall. On there I have installed fail2ban – although it looks as if denyhosts would be a better option, since that protects against distributed attacks.
I want something similar for wordpress – ideally I would like a plugin that replicates denyhosts – but the closest thing I have found is “Login LockDown” – which I have just installed and I hope that it works OK.
Other options to try would be:
- .htaccess changes to allow only my IP to the admin pages
- .htaccess changes to block prolific bandwidth leechers – I can’t be bothered to do this as don’t have the time!
- continue hunting for a distributed solution like denyhosts
Maybe I just have a very strange fan of my blog who spends a lot of time on it!
As an interesting-ish aside – here are the last usernames that tried and failed to login to my ssh server:
sudo lastb | awk '{print $1}' | sort | uniq -c
1
2 abel
2 abelia
4 admin
2 alexis
2 anonymou
2 apple
1 btmp
2 cyrus
2 eaguilar
6 guest
2 httpd
2 mat3
2 mat4
2 matt4
2 messenge
1 nobody
2 oracle
2 passwd
4 patrick
2 payala
4 plcmspip
2 PlcmSpIp
57 root
4 test
2 upload
2 www-data
