• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 328
  • Last Modified:

Preventing brute force attacks

Hi all, I'm interested in software to prevent brute force attacks to RDP etc, I have found software called RDPguard but have never seen it mentioned before, anyone know if it's legit or another fake?

Also are there any other solutions to brute force attacks? I have changed the RDP port but still the event log fills with audit failures.

Thanks all
0
Leigh2004
Asked:
Leigh2004
3 Solutions
 
Sajid Shaik MSr. System AdminCommented:
you can deploy certificate server SSL

to make it secure...

http://technet.microsoft.com/en-us/magazine/ff458357.aspx

as well

http://www.petri.co.il/securing_rdp_communications.htm

all the best
0
 
Leigh2004Author Commented:
Thanks shaiksaj, but I am more interested in the ip blocking method as RDPguard claims to be able to do, as that would also protect ftp, mssql etc

I have just found another called E-Guardo but that looks very dubious to me, also one called Syspeace with an outrageous pricing plan, any opinions on any of these ?
0
 
Rich RumbleSecurity SamuraiCommented:
The OS can do this for you, it's built-in... use Secpol.msc, got to account policies. Adjust the lockout and duration thresholds if need be. You can also try these settings: http://technet.microsoft.com/en-us/library/cc783225%28v=ws.10%29.aspx
You can use secpol.msc to limit what users and groups can RDP, remove administrator, and only allow those in the RemoteDesktop group. Change the Administrator account name as a best practice.
http://www.umanitoba.ca/about/media/IST_Securing_Remote_Desktop_on_XPpro.pdf
-rich
0
 
skullnobrainsCommented:
you will ALWAYS have failed connections filling up your logs whenever any service is open to the internet whatever the port.

using secure passwords is a good start

monitoring successfull connection attempts is useful

monitoring failed attempts and locking out the ips is mildly useful because attacks can be run from plenty of ips at the same time

limiting the number of failed attemps per user is very efficient if combined with forced password changes but might efficiently make you unable to connect to your system because of an attack. but combined with the previous and possibly ip whitelisting policies uppon successfull attemps, this can produce excellent security.

opening the RDP port only to users who successfully connected to a different service can also be a good way to prevent most such attacks.

---

bottomline is it is not a matter of software but rather of policy. it is also very likely that you can reasonably ignore these events altogether. maybe tell us more about your situation (number of users, attck frequency, existing firewall...) so we can get a better idea.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now