Prevent dictionary based attack on ftp server

Hi.I have a big problem right now. I am running a ftp server running on
windows server 2003 and iis 6.0. To my horror when i checked my ftp site log
file, i found thousands of 331 and 530 entries using the administrator
account. I knew someone out there was trying to do a dictionary based attack
on my server to crack the administrator password. The immediate action action
i took was to change the administrator account name to something else and
password. I already configured account lockout threshold and duration on the
local gpo of the server. However, it seems the account threshold and duration
restrictions only works on non administrator accounts. Is there any way i can
apply the restriction to the administrator account too? Please help. Thank
you.

Re: Prevent dictionary based attack on ftp server

Hmm, what you want to do sounds like a bad idea.

Suppose you can configure a lockout threshold on the administrator
account. That means that someone can continuously run an unsuccessful
attack against your administrator account and permanently lock you out
from ever using the administrator account.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//



On Mar 12, 2:54 pm, mdhairil
wrote:
> Hi.I have a big problem right now. I am running a ftp server running on
> windows server 2003 and iis 6.0. To my horror when i checked my ftp site log
> file, i found thousands of 331 and 530 entries using the administrator
> account. I knew someone out there was trying to do a dictionary based attack
> on my server to crack the administrator password. The immediate action action
> i took was to change the administrator account name to something else and
> password. I already configured account lockout threshold and duration on the
> local gpo of the server. However, it seems the account threshold and duration
> restrictions only works on non administrator accounts. Is there any way i can
> apply the restriction to the administrator account too? Please help. Thank
> you.

Re: Prevent dictionary based attack on ftp server

"David Wang" wrote in message
news:1173776339.631142.179030@v33g2000cwv.googlegroups.com.. .
> Hmm, what you want to do sounds like a bad idea.
>
> Suppose you can configure a lockout threshold on the administrator
> account. That means that someone can continuously run an unsuccessful
> attack against your administrator account and permanently lock you out
> from ever using the administrator account.


The best answer seems to be to create a long (secure) administrator
password, and check that your FTP server implements a delay on responding to
failed password attempts, so that the attacker can't try many passwords per
second. With a sufficiently long password (throw four or five words
together), it won't even matter if the delay isn't present, the attacker
simply isn't likely to hit the right password in his lifetime.

Note that if you run a server on the public Internet, you will _always_ have
people trying to connect to it using their own choice of authentication -
user names and passwords, etc. This is mostly just a sign that there are
large numbers of malicious people out there, and your server will just plain
have to deal with it.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.

Re: Prevent dictionary based attack on ftp server

On Mar 12, 3:54 pm, mdhairil
wrote:
> Hi.I have a big problem right now. I am running aftpserverrunning on
> windowsserver2003 and iis 6.0. To my horror when i checked myftpsite log
> file, i found thousands of 331 and 530 entries using the administrator
> account. I knew someone out there was trying to do a dictionary based attack
> on myserverto crack the administrator password. The immediate action action
> i took was to change the administrator account name to something else and
> password. I already configured account lockout threshold and duration on the
> local gpo of theserver. However, it seems the account threshold and duration
> restrictions only works on non administrator accounts. Is there any way i can
> apply the restriction to the administrator account too? Please help. Thank
> you.

I'm not sure if IIS supports this, but another approach is to block
the IP after too many unsuccessful attempts v.s. shutting down the
account. This way you don't have the problem of a user locking out an
account ... instead access from that IP is just blocked altogether.
The server we use here supports this option ( http://www.jscape.com/secureftpserver/
) ... coupled with an email notification when an attacker is blocked
works well for us.