IIS8 FTP Brute Force Protection

Question

Hello everyone , I have two questions in regards to FTP BF Protection 1) I've setup BruteForce protection and it is working partially OK, however web browsers to the FTP upon change of directory or refresh of the page re-initiate the connection as anonymous, causing all my users to be blocked after a few attempts. I know the proper way would be to force anyone to use an FTP client, but I cannot enforce it. How do you manage the brute force to prevent browser user from being blocked? 2) Once an IP address is blocked by the FTP, how can I see it and is there a way to unblock it? I cannot even see anything in the logs : ie blocked by policy or any sorts Thanks

Answer 1

Hello Julian,

After reading these KBs, it appears to be a relatively simple solution without much ability to look at the underlying workings.

https://learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/iis-80-ftp-logon-attempt-restrictions

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831839(v=ws.11)

If you detail the scope of your project, maybe there are some better options to achieve the requirements?

Answer 2

Hi Miguel,

The 1st article is the one I used to setup the BF protection
The 2nd article does not load - 404
IP whitelisting is not ideal or manageable, but yes, I have considered it

Scope:
Prevent bruteforce attacks on the FTP server - as per the logs, a lot of attempts
Some users use internet browsers to access the FTP, and each refresh generates an anonymous connection which adds to the count of failed logins, and eventually get blocked
I have a workaround, but it makes no sense to have a block facility without any visibility into what is being blocked, or the ability to remove it

I am 100% those IP addresses are stored somewhere for the service to be able to deny them access (whitelist, blacklist), so we should somehow be able to view them - even powershell would be great.

Thanks

Answer 3

Hi,

As your issue is more related with IIS and FTP, I recommend to ask for help from IIS forum. They should more familiar with your issue and might could provide more suitable resources and suggestion.

Bests,