While there is no good reason to not use TLS to safeguard this, your approach seems okay and here is why:
The computational complexity of hashing sha 256 and encrypting it with (asymmetrical or hybrid) algorithms is fairly high; there is (currently) no feasible way to brute force that if the passwords are reasonably strong.
Additionally, if you are worried about brute force, you can ban an IP for x hours if the password is entered wrong y times in a row - like fail2ban does - and/or add additional time between logins like GNU/Linux does.
That being said: there is a perfectly good way to authenticate users securely and that is TLS.