Security Advisory: DirectAdmin FTP Brute-Force Rate Limiting Bypass
A rate-limiting bypass affecting FTP authentication on DirectAdmin servers is fixed in this security release: brute-force protections could be evaded, weakening the first line of defense for FTP credentials. Update the DirectAdmin FTP stack and keep complementary protections enabled.
Затронутые версии
DirectAdmin 1.671 and earlier
Исправленная версия
DirectAdmin 1.672
Команда обновления по умолчанию
yum update -yКоманды исправления
AlmaLinux 9 / CloudLinux 9
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadCentOS 7 / CloudLinux 7
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadUbuntu 22.04 / Debian 12
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadЧто это значит по лицензии SharedLicense
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
Rate limiting is what turns an FTP brute-force attempt from feasible into impractical. The flaw let an attacker evade those counters — cycling connections so each new attempt looked fresh — which restores the attacker’s math advantage against weak or reused passwords.
Who is affected
DirectAdmin servers offering FTP access, particularly accounts whose users connect with simple passwords.
How to apply the fix
- Update DirectAdmin and the FTP server (ProFTPd or Pure-FTPd) via CustomBuild.
- Keep fail2ban-style blocking active for authentication services.
- Encourage or enforce stronger FTP credentials on hosted accounts.
For SharedLicense customers
Licensing is unaffected. This is a low-severity fix, but it stacks with good password policy — patch it during the regular cycle.
Часто задаваемые вопросы
Why does a rate-limiting bypass matter?
What should I change besides the update?
Is this urgent?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему