AiDisks under password guessing attack

[Blackstar]

After two weeks of setting up AiDisks for local network file sharing among my family members for the first time, a week later, someone began attempting to guess the password for access every five minutes, with five login attempts. As a result, I increased the timeout to 60 minutes with a limit of two login attempts. However, the individual has persisted in their attempts. Should I be concerned? Here's the latest log from just minutes ago.

Mar 20 23:23:46 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 79.110.62.117 in login.
Mar 20 23:26:36 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login lock.

 

[Dedel66]

Please tell a little more precise how you set up your disks. Didn't you set up a vpn-server for sharing?

 

[bbunge]

After two weeks of setting up AiDisks for local network file sharing among my family members for the first time, a week later, someone began attempting to guess the password for access every five minutes, with five login attempts. As a result, I increased the timeout to 60 minutes with a limit of two login attempts. However, the individual has persisted in their attempts. Should I be concerned? Here's the latest log from just minutes ago.

Mar 20 23:23:46 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 79.110.62.117 in login.
Mar 20 23:26:36 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login lock.

Welcome to the world of the Internet! You are likely being hit by a bot. Might be best to not use AiDisk but use a cloud service instead.

 

[elorimer]

Caracas IP, .ru domain, listed for brute force attacks. Add it to skynet?

 

[rquinn19]

After two weeks of setting up AiDisks for local network file sharing among my family members for the first time, a week later, someone began attempting to guess the password for access every five minutes, with five login attempts. As a result, I increased the timeout to 60 minutes with a limit of two login attempts. However, the individual has persisted in their attempts. Should I be concerned? Here's the latest log from just minutes ago.

Mar 20 23:23:46 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 79.110.62.117 in login.
Mar 20 23:26:36 httpd_login_lock: Detect abnormal logins at 5 times. The newest one was from 179.60.147.41 in login lock.

I'd be weary of opening anything up to the public in this manner. Especially if there's no ability for OTP or MFA or Geo-IP blacklists at a minimum. Shodan and other sites will eventially show what ports and services are open to the public on your public IP and you will get hammered from everywhere.