Brute force on the control panel

Every panel on a public address is being tried constantly by machines working through lists of usernames and leaked passwords. The volume is not a sign that you are targeted. It becomes a breach the moment one account has a password that appears on one of those lists.

See what is happening

sudo grep -c "Failed password" /var/log/auth.log
sudo awk '/Failed password/ {print $(NF-3)}' /var/log/auth.log | sort | uniq -c | sort -rn | head

The four that end it

• Two-factor on every admin account. A correct password alone stops being enough - see two-factor on the panel.
• Rate limiting, so a machine gets a handful of attempts a minute rather than thousands - see rate limiting a login endpoint.
• Fail2ban, to ban the address after a few failures - see what Fail2ban stops.
• No shared accounts. One person, one login, so a removal is one removal.

Rename admin, and do not rely on it

Changing the obvious username removes most of the automated noise, because the lists are short on usernames and long on passwords. It is not protection: the name is usually discoverable from the site itself.

Restrict where the panel answers at all

# nginx: the panel only answers to the office
location /admin/ {
    allow 203.0.113.0/24;
    deny all;
}