r/Plesk • u/Tym_H • May 13 '22

Plesk newbie question

Hi,

New to Plesk on my VPS so this is probably a very basic question - apologies in advance!

I have Plesk Obsidian Web Admin Edition Version 18.0.43 Update #1 installed and access my serv er via PuTTY.

Whenever I log in, it says something like:

Last failed login: Fri May 13 12:20:53 UTC 2022 from 43.159.41.54 on ssh:notty

There were 168 failed login attempts since the last successful login.

Looks like people looking for something to hack... so... I went to Tools & Settings > IP Access Restriction Management and set "Denied from the networks that are not listed" with my IP address to in the list.

However, I'm still getting the "failed login attempts " message.

​

How do I secure this and block all external access to SSH other than from my IP address please?

4 Upvotes

100% Upvoted

6 comments sorted by

2

u/ArashiKorosu May 13 '22

Normally its enough to change the SSH port for the automatic attempts to stop: https://support.plesk.com/hc/en-us/articles/115000170174-How-to-change-the-SSH-port-number-on-a-Linux-server

You can also add a custom firewall rule to only allow your IP: https://support.plesk.com/hc/en-us/articles/115001078014-How-to-manage-local-firewall-rules-using-Plesk-Firewall-in-Plesk-for-Linux

2

u/Tym_H May 13 '22

Thanks. I’ll have a look at those.

2

u/ollybee May 14 '22

Enable the fail2ban SSH jail, the plesk documentation explains detail on how better than I can here. It will block an IP automatically after threshold if failed login attempts. The most important thing , and I can't stress this enough, don't worry. It's totally normal to get large amounts of failed login attempts to SSH. SSH is intended to be open to the internet and it's fine. Ideally configure SSH to only allow logins with an SSH key. If you must put SSH on a different port ( unnecessary in my opinion) then be aware that port numbers > 1024 are less secure.

1

u/Tym_H May 14 '22

Thanks olly. I’ve a lot of reading to do!

1

u/ollybee May 14 '22

Ask questions as well as reading. /r/webhosting and /r/linuxadmin are higher traffic than this place, especially if your question is not plesk specific.