Security Advisory: DirectAdmin FTP Brute-Force Rate Limiting Bypass
A rate-limiting bypass affecting FTP authentication on DirectAdmin servers is fixed in this security release: brute-force protections could be evaded, weakening the first line of defense for FTP credentials. Update the DirectAdmin FTP stack and keep complementary protections enabled.
Betroffene Versionen
DirectAdmin 1.671 and earlier
Gepatchte Version
DirectAdmin 1.672
Standard-Update-Befehl
yum update -yFix-Befehle
AlmaLinux 9 / CloudLinux 9
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadCentOS 7 / CloudLinux 7
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadUbuntu 22.04 / Debian 12
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadWas das unter einer SharedLicense-Lizenz bedeutet
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
Rate limiting is what turns an FTP brute-force attempt from feasible into impractical. The flaw let an attacker evade those counters — cycling connections so each new attempt looked fresh — which restores the attacker’s math advantage against weak or reused passwords.
Who is affected
DirectAdmin servers offering FTP access, particularly accounts whose users connect with simple passwords.
How to apply the fix
- Update DirectAdmin and the FTP server (ProFTPd or Pure-FTPd) via CustomBuild.
- Keep fail2ban-style blocking active for authentication services.
- Encourage or enforce stronger FTP credentials on hosted accounts.
For SharedLicense customers
Licensing is unaffected. This is a low-severity fix, but it stacks with good password policy — patch it during the regular cycle.
Häufig gestellte Fragen
Why does a rate-limiting bypass matter?
What should I change besides the update?
Is this urgent?
Referenzen
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen