how to beat brute force attacks on Linux server

Hi GernotMeyer 

You can create a custom IPS policy and add a required signature and apply on the firewall rule - https://docs.sophos.com/nsg/sophos-firewall/v16058/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/IpsPolicyDetailEdit.html

If you want to allow or block SSH service for firewall, you can create Local ACL rule - https://community.sophos.com/kb/en-us/132814#Local%20Service%20ACL%20Exception%20Rule

Keyur, thanks for answer.

There are so many existing IPS policies in XG.

There is no existing one taking care of this behavour?

I am unable to determine that one (if existing).

Hi GernotMeyer 

You may create customer IPS policy and add signatures by searching Brute force and all those signatures.

You can edit General policy available in IPS, go to generalpolicy >> remove existing added details or you may keep it as per your requirement >> Click on Add will open a new tab >> Select "Select individual signature" and apply "Name" filter and add a string as brute force, it will list available signature for brute force, select them and click on save.

Please also check Vishal_R response in the previous thread.

Even this thread would helpful - https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120481/fail2ban-and-waf

Hi GernotMeyer 

You may create customer IPS policy and add signatures by searching Brute force and all those signatures.

You can edit General policy available in IPS, go to generalpolicy >> remove existing added details or you may keep it as per your requirement >> Click on Add will open a new tab >> Select "Select individual signature" and apply "Name" filter and add a string as brute force, it will list available signature for brute force, select them and click on save.

Please also check Vishal_R response in the previous thread.

Even this thread would helpful - https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120481/fail2ban-and-waf