DirectAdmin’s Brute Force Monitor, commonly called BFM, is one of the first security controls worth reviewing after deploying a hosting VPS. It watches authentication activity and can blacklist IP addresses after excessive failed attempts. DirectAdmin has also continued improving BFM performance, making it more useful on busy servers.
How DirectAdmin BFM works
BFM records failed authentication activity and can block IP addresses that exceed configured thresholds. DirectAdmin’s documentation exposes settings such as bruteforce, brutecount and brute_dos_count. The panel also provides Failed Logins, IP List, Username List, Skip List and Block List views.
7 settings and checks worth reviewing
- Global BFM enablement: make sure brute-force monitoring is actually enabled.
- Login threshold: review the number of failed DirectAdmin logins required before a block.
- Unauthorized connection threshold: review the separate threshold for repeated access to the login endpoint.
- Skip list: document trusted monitoring or management sources rather than blindly adding large networks.
- Block list: periodically review blocked addresses for patterns and accidental lockouts.
- Username patterns: inspect repeated attempts against nonexistent or privileged usernames.
- Logs: correlate BFM events with SSH, mail, FTP and web-server logs when investigating an attack.
How to avoid false positives
Security thresholds are a balance. Very aggressive settings may block legitimate users behind shared corporate NAT, monitoring systems or support networks. Very loose settings allow more guessing attempts. Start from the documented defaults for your environment, then tune based on actual traffic.
Do not whitelist a broad ISP range just because one employee was blocked. Prefer a narrowly scoped administrative IP or VPN egress address, and keep a record of why it was added.
BFM is only one layer
BFM protects authentication paths; it does not replace strong passwords, SSH key authentication, MFA where supported, firewall rules, patched software or application-level security. On a hosting server, also protect the control panel, mail services and web applications.
When a DirectAdmin license is the right next step
If you are building a small hosting server or moving away from a more expensive panel, DirectAdmin is often considered because it combines a control panel with server-management features such as BFM. LicenseCage offers DirectAdmin licensing for VPS and dedicated-server setups. See the current license catalogue when comparing your monthly server software cost.
FAQ
Does BFM protect SSH?
BFM has broader monitoring capabilities than its original DirectAdmin-only implementation, but SSH should still have its own hardening and access controls.
Should I lower the login threshold as much as possible?
No. Excessively low thresholds can create unnecessary lockouts. Tune the setting to your legitimate traffic and threat level.
Where can I inspect BFM blocks?
DirectAdmin provides a Brute Force Monitor interface with failed-login and block-list views.
Practical takeaway: spend a few minutes reviewing BFM before your VPS becomes a target. It is inexpensive security compared with recovering a compromised hosting account.
Source: DirectAdmin BFM documentation and the DirectAdmin 1.701 changelog.
