Detect and blacklist bruteforce attacks

[#1]

Is there any way I could blacklist IP' s that attempt bruteforce password services, such as FTP and RDP servers? Edit: Fortigate 100A. 4.0 mr2 patch 2

[Carl_Wallmark]

You can create custom IPS sensors to detect bruteforce and ban the IP if you like, Here is one for FTP: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32342&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=18697247&stateId=0 0 18699059

[#3]

Ah, nice!! Thank you! I will try to figure out how to do the same with RDP.

[Carl_Wallmark]

RDP will be more tricky, beacuse RDP is encrypted, so the FortiGate can' t see the trafic, but it could detect connection attempts, and then you could limit it to say 10 connections per minute and then block/ban or something.

[#5]

Yes, I see it will be a problem to detect login failure on rdp. If you or someone else have a signature I can use to detect repeated RDP logon attempts, it would be great.. Or is there any better ways to get rid of those ***** trying to bruteforce RDP accounts? They are constantly trying, causing account lockouts. I' m manually building a list of the worst attacker IP' s and putting them into a deny rule, but it' s a endless fight.

[rwpatterson]

Are you allowing RDP directly through from the Internet? Stopping that and using SSL or IPSec VPN would put a halt to that rather quickly.

[Carl_Wallmark]

i agree with Bob on that, there are a few things you can do without VPN first, 1. In MR3 (when its stable enough) you can make the user to login via the SSL Portal, there they will find a link to the RDP server, when clicking it it will fire up the local RDP client on the computer and connect, very nice ! 2. Create a authentication policy together with the RDP policy, the user will have to authenticate against the firewall before RDP is possible. 3. In MR3 you have the ability to create Geography policys, for example you just want to allow Spain to connect, its not the most solid solution but it should take down around 90 % of the attackers.

[lmuir]

2008 and later - After each invalid password attempt there is a FIN,ACK. So I guess you could look for x number of FIN,ACK in x time to dst tcp port 3389. Might want to do a lot of testing as you might get undesirable results. 2003 and earlier - Looks to be fairly clear text, creating a rule shouldn' t be too hard. Edit: Here' s a Snort rule I found for blocking Administrator from RDP on 2000/2003, which you could base your brute force rule on - alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:" POLICY RDP attempted administrator connection request" ; flow:to_server,established; content:" |E0|" ; depth:1; offset:5; content:" mstshash" ; distance:0; nocase; content:" Administr" ; distance:0; nocase; pcre:" /mstshash\s*\x3d\s*Administr/smi" ; reference:bugtraq,14259; reference:cve,2005-1218; reference:url,www.microsoft.com/technet/security/bulletin/MS05-041.mspx; classtype:misc-activity; sid:4060; rev:4;) I' m just not seeing that traffic in my packet captures so you might have to do a little digging. Otherwise, if you ask TAC they might be able to create one for you, I' ve had great results with IPS sigs from TAC.

[#9]

Ok, 24hour+ spent trying to build signatur. Will try another solution now. [:' (] I' ve enabled SSL VPN and created a portal. But the Fortigate does not respond on https://192.168.0.1:10443/. Also tried creating a firewall policy rule from WAN to " sslvpn tunnel interface" to get access to portal on the wan IP. Is there something else I' m missing?

[rwpatterson]

You either need to create a policy from internal to ssl.root or try the connection from the outside (using the WAN IP address, of course).