Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Preventing brute force attacks

Posted on 2013-06-30
4
Medium Priority
?
324 Views
Last Modified: 2014-10-07
Hi all, I'm interested in software to prevent brute force attacks to RDP etc, I have found software called RDPguard but have never seen it mentioned before, anyone know if it's legit or another fake?

Also are there any other solutions to brute force attacks? I have changed the RDP port but still the event log fills with audit failures.

Thanks all
0
Comment
Question by:Leigh2004
4 Comments
 
LVL 17

Assisted Solution

by:Sajid Shaik M
Sajid Shaik M earned 668 total points
ID: 39287972
you can deploy certificate server SSL

to make it secure...

http://technet.microsoft.com/en-us/magazine/ff458357.aspx

as well

http://www.petri.co.il/securing_rdp_communications.htm

all the best
0
 

Author Comment

by:Leigh2004
ID: 39288087
Thanks shaiksaj, but I am more interested in the ip blocking method as RDPguard claims to be able to do, as that would also protect ftp, mssql etc

I have just found another called E-Guardo but that looks very dubious to me, also one called Syspeace with an outrageous pricing plan, any opinions on any of these ?
0
 
LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 664 total points
ID: 39288496
The OS can do this for you, it's built-in... use Secpol.msc, got to account policies. Adjust the lockout and duration thresholds if need be. You can also try these settings: http://technet.microsoft.com/en-us/library/cc783225%28v=ws.10%29.aspx
You can use secpol.msc to limit what users and groups can RDP, remove administrator, and only allow those in the RemoteDesktop group. Change the Administrator account name as a best practice.
http://www.umanitoba.ca/about/media/IST_Securing_Remote_Desktop_on_XPpro.pdf
-rich
0
 
LVL 27

Accepted Solution

by:
skullnobrains earned 668 total points
ID: 39306484
you will ALWAYS have failed connections filling up your logs whenever any service is open to the internet whatever the port.

using secure passwords is a good start

monitoring successfull connection attempts is useful

monitoring failed attempts and locking out the ips is mildly useful because attacks can be run from plenty of ips at the same time

limiting the number of failed attemps per user is very efficient if combined with forced password changes but might efficiently make you unable to connect to your system because of an attack. but combined with the previous and possibly ip whitelisting policies uppon successfull attemps, this can produce excellent security.

opening the RDP port only to users who successfully connected to a different service can also be a good way to prevent most such attacks.

---

bottomline is it is not a matter of software but rather of policy. it is also very likely that you can reasonably ignore these events altogether. maybe tell us more about your situation (number of users, attck frequency, existing firewall...) so we can get a better idea.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

What monsters are hiding in your child's room? In this article I will share with you a tech horror story that could happen to anyone, along with some tips on how you can prevent it from happening to you.
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question