Prevent brute force attacks on web publishing logins

Question

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc.

But what about the web publishing logins (Web-Deploy, FTP, ...)? How do we prevent anyone brute forcing those? Is the only way to have a password that cannot practically be brute forced, or is there any other method that can be implemented for that?

This is exacerbated by the fact that the control panel login is often valid for web publishing as well, so an attacker can try the passwords on publishing, and if successful - have access to the control panel as well.

EDIT

The question is about a website hosted on a shared web hosting service with quite limited control over the server. Is there anything that can be done by someone using the hosting service to counter a brute force attack?

Answer 1

There are a number of ways of mitigating brute-force attacks, depending on the level of control and access you have to the systems in question.

At a firewall level, you may be able to do rate limiting to throttle the number of connections from a given IP address. Also some firewalls will have Intrusion Prevention System capabilities which could allow for brute-force attacks to be throttled or blocked.

At a system level similar principles can be applied. Software like Fail2Ban can be used to block brute-force password guessing attacks by blocking the source IP addresses of those attacks.

This kind of blocking isn't perfect against a determined attacker as they can switch IP addresses to get round it, but it will generally work fine for the less targeted attacks.