Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

Detect and blacklist bruteforce attacks

Is there any way I could blacklist IP' s that attempt bruteforce password services, such as FTP and RDP servers? Edit: Fortigate 100A. 4.0 mr2 patch 2
11 REPLIES 11
Carl_Wallmark
Valued Contributor

You can create custom IPS sensors to detect bruteforce and ban the IP if you like, Here is one for FTP: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32342&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=18697247&stateId=0 0 18699059

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

Ah, nice!! Thank you! I will try to figure out how to do the same with RDP.
Carl_Wallmark
Valued Contributor

RDP will be more tricky, beacuse RDP is encrypted, so the FortiGate can' t see the trafic, but it could detect connection attempts, and then you could limit it to say 10 connections per minute and then block/ban or something.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

Yes, I see it will be a problem to detect login failure on rdp. If you or someone else have a signature I can use to detect repeated RDP logon attempts, it would be great.. Or is there any better ways to get rid of those ***** trying to bruteforce RDP accounts? They are constantly trying, causing account lockouts. I' m manually building a list of the worst attacker IP' s and putting them into a deny rule, but it' s a endless fight.
rwpatterson
Valued Contributor III

Are you allowing RDP directly through from the Internet? Stopping that and using SSL or IPSec VPN would put a halt to that rather quickly.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Carl_Wallmark
Valued Contributor

i agree with Bob on that, there are a few things you can do without VPN first, 1. In MR3 (when its stable enough) you can make the user to login via the SSL Portal, there they will find a link to the RDP server, when clicking it it will fire up the local RDP client on the computer and connect, very nice ! 2. Create a authentication policy together with the RDP policy, the user will have to authenticate against the firewall before RDP is possible. 3. In MR3 you have the ability to create Geography policys, for example you just want to allow Spain to connect, its not the most solid solution but it should take down around 90 % of the attackers.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
lmuir
New Contributor

2008 and later - After each invalid password attempt there is a FIN,ACK. So I guess you could look for x number of FIN,ACK in x time to dst tcp port 3389. Might want to do a lot of testing as you might get undesirable results. 2003 and earlier - Looks to be fairly clear text, creating a rule shouldn' t be too hard. Edit: Here' s a Snort rule I found for blocking Administrator from RDP on 2000/2003, which you could base your brute force rule on - alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:" POLICY RDP attempted administrator connection request" ; flow:to_server,established; content:" |E0|" ; depth:1; offset:5; content:" mstshash" ; distance:0; nocase; content:" Administr" ; distance:0; nocase; pcre:" /mstshash\s*\x3d\s*Administr/smi" ; reference:bugtraq,14259; reference:cve,2005-1218; reference:url,www.microsoft.com/technet/security/bulletin/MS05-041.mspx; classtype:misc-activity; sid:4060; rev:4;) I' m just not seeing that traffic in my packet captures so you might have to do a little digging. Otherwise, if you ask TAC they might be able to create one for you, I' ve had great results with IPS sigs from TAC.
Not applicable

Ok, 24hour+ spent trying to build signatur. Will try another solution now. [:' (] I' ve enabled SSL VPN and created a portal. But the Fortigate does not respond on https://192.168.0.1:10443/. Also tried creating a firewall policy rule from WAN to " sslvpn tunnel interface" to get access to portal on the wan IP. Is there something else I' m missing?
rwpatterson
Valued Contributor III

You either need to create a policy from internal to ssl.root or try the connection from the outside (using the WAN IP address, of course).

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors