Re: How to limit number of failed FTP logins?

From: Ralph Hulslander (RalphHulslander_at_discussions.microsoft.com)
Date: 11/01/05

  • Next message: Steven L Umbach: "Re: How to limit number of failed FTP logins?" 
    Date: Tue, 1 Nov 2005 05:34:03 -0800

    Thanks Steven for the reply, This box is only ruuning IIS there are no local
    usersand it is sitting behind a appparently efficient firewall.

    I was wondering if I could use GPO to limit the number of login attempts on
    the FTP port or if there was a a firewall or Dnial of Service monitor that
    could do it. The problem with using a firewall is of course the port is open,
    so "most" firewalls do not monitor that port as strictly.

    Or does anyone have a script monitoring the Event log? I would guess that a
    script could monitor the Event log and if it sees repeated failures login
    failures then it could shut off FTP for a designated time and then restore
    it.

    After everyone of these attacks I can block the IP address but that is
    closing the door after the horse has escaped. The IP address is never reused.

    Thanks again for the reply.
    Ralph 

    -- 
Progress is just a faster road to the end.
"Steven L Umbach" wrote:
> Maybe something else is attracting them to your server such as other ports 
> being open to the internet other than for FTP. Try using one of the self 
> scan sites such as http://scan.sygatetech.com/ to see if there are any other 
> ports open such as netbios/file and print sharing which can draw a lot of 
> attention from internet users and would be evidenced by failed logons to non 
> default user accounts for users that you have created. File and print 
> sharing should be disabled on external network adapters. Normally you can 
> set an account lookout policy for user accounts in Local Security Policy but 
> I don't know offhand if that will work for FTP logon attempts for user 
> accounts and can end up blocking access to the legitimate user by locking 
> their account. I would also suggest that you run Microsoft Baseline Security 
> Analyzer on your server and the IIS Lockdown tool to help you secure it and 
> check for basic vulnerabilities.  Before running the IIS Lockdown tool it 
> would be a good idea to a full backup of your server event though IIS 
> Lockdown tool is supposed to be removable. It would also be a good idea to 
> add those IPs to a block filter rule for your firewall if they are not too 
> numerous.   --- Steve
> 
> http://www.microsoft.com/technet/security/tools/mbsahome.mspx   --- MBSA
> http://www.microsoft.com/technet/security/tools/locktool.mspx  --- IIS 
> Lockdown tool
> 
> 
> "Ralph Hulslander" <RalphHulslander@discussions.microsoft.com> wrote in 
> message news:DE525BB9-C1CC-4D31-87AD-D0405F9AF6F8@microsoft.com...
> >
> > A Windows 2000 server is being subjected to a continuous stream of login
> > attempts.
> > Essentially this was causeing a denial of service until I set the Event 
> > Log
> > to overwrite once full.
> > Is there any way to  limit the login attempts. None of the attempts are
> > successful.
> > These attacks come from random IP's and are proceded by a initiating event
> > (attempted login) that is followed by a flood of attempts.
> >
> > The machine is not using AD.
> >
> > Thanks 
> 
> 
>
  • Next message: Steven L Umbach: "Re: How to limit number of failed FTP logins?"

    Relevant Pages

    • Re: Which Router for VPN and Webhosting
      ... can be stopped with proper configuration and patching of the OS and IIS. ... further compromise by a firewall that is not located on the host itself. ... > Any IP that was doing TCP or UDP port scans O/S Finger Prints or SQL ... > to me and I can rebuild and have rebuilt them at the drop of a hat. ...
      (comp.security.firewalls)
    • Re: Creating a Web Site and publishing it
      ... To what application do I have to allow access in my firewall. ... (usually port 80 for IIS, but it's random using the built in VS web server ...
      (microsoft.public.dotnet.general)
    • Re: XPs built in VPN
      ... is there any way to make this work without asking the network administrator to change the firewall settings? ... I work under the IT dept and the administrators office is right across the hall from me, but I would never ask him to change the firewall for something so unnecessary. ... SSH - if you firewall does not block port 22. ... Run IIS on your Home PC, map the directory you want to ...
      (comp.dcom.vpn)
    • Re: Understanding Firewall-1 Configs
      ... You should not fear of an attack taking down the firewall, ... port 53 to the DNS server port 80 and ... >You are not able to ping the firewall from the Internet. ... >- -on port 80 to public ip address of IIS is NAT's to internal IP address of IIS ...
      (Security-Basics)
    • Re: keeping ports open
      ... If a port is open, it means that 1) a software or service is running on your ... and 2) you're not using a firewall or your firewall isn't ... Use firewall software and hardware and antivirus software that is ... Follow the instructions for hardening Windows and IIS at ...
      (microsoft.public.security)