@everyone —
I've released
[email protected] to address issues stemming from brute force attempts on the SFTP port. These attempts targeted many users, but were unlikely to be targeted specifically at Pterodactyl, rather a bot detecting the open port and attempting to brute force access using a dictionary attack.
Thanks to @Trixter the
standalone SFTP server will no longer even attempt to authenticate users that pass an invalid format in the username. Additionally, the IP address of the client is now logged in the output allowing you to use tooling such as
fail2ban to automatically block connections.
Not using the standalone SFTP server? Check out the documentation here:
https://pterodactyl.io/daemon/0.6/standalone_sftp.html
Trying to figure out how to upgrade? You should double check the install instructions, but for the most part you should only need to re-download the new binary and restart it.
cd /srv/daemon
curl -Lo sftp-server https://github.com/pterodactyl/sftp-server/releases/download/v1.0.5/sftp-server
chmod +x sftp-server
systemctl restart pterosftp