Maximum Logon Attempts

[Guest]

I have installed IIS on Windows 2000 and configured and FTP site, which is
needed for a remote consulting company to upload data.

Since opening up FTP on the firewall, I've had repeated login attempts by
unauthorized user(s) who appear to be using some kind of utility to cycle
through passwords. The event viewer is full of "The server was unable to
logon the Windows NT account 'administrator' due to the following error:
Logon failure: unknown user name or bad password" errors.

My question is, does anyone know if there is a way to configure IIS so
that an FTP connection is closed after a set number of failed logon attempts?
It seems crazy to allow the hacker to just keep plugging away. Unfortunately,
the source address keeps changing, so blocking the address at the firewall is
no good. Additionally, the source address for the legitimate company is also
dynamic, so the preferred solution of locking everyone out except for the one
company also not feasible.

 

[karl levinson, mvp]

My question is, does anyone know if there is a way to configure IIS so
that an FTP connection is closed after a set number of failed logon
attempts?
It seems crazy to allow the hacker to just keep plugging away.
Unfortunately,
the source address keeps changing, so blocking the address at the firewall
is
no good.

No, Windows does not have such an ability natively. Most such solutions
would I think have to rely on the source IP to prevent the person from
immediately re-establishing a new session, which of course wouldn't help
make your logs very much shorter.

Additionally, the source address for the legitimate company is also
dynamic, so the preferred solution of locking everyone out except for the
one
company also not feasible.

Well, you could set up VPN or a VPN or IPSec tunnel so that only they can
get in. For example, an IPSec tunnel where client certificates are required
to identify the client computer.

You could also disable or rename the Administrator account, so that any such
log entries about administrator won't concern you as much.

Other than this, most people with public FTP servers have to put up with
this sort of noise. It's harmless to you, as long as you have strong
passwords.