Windows Server 2012 : Scalable and elastic web platform (part 6) - FTP Logon Attempt Restrictions

Understanding FTP logon attempt restrictions

Running an FTP service on an Internet-facing server has unfortunately yielded an additional surface area for attack for server administrators to manage. Because hackers can connect to an FTP service with a wide array of publicly available or special-purpose FTP clients, an FTP server offers a way for hackers to continuously send requests to guess a username/password combination and gain access to an account on a server.

This situation has required server administrators to implement additional security measures to counter this behavior; for example, server administrators should always disable or rename well-known accounts like the Administrator or Guest accounts. Administrators should also implement policies that enforce strong passwords, password expiration, and password lockouts. An unfortunate downside to password lockouts is that a valid account can be locked out by a hacker who is attempting to gain access to the account; this may require the server administrator to re-enable accounts that have been locked out as a result of good password management practices.

From an FTP 7 perspective, there are additional measures that server administrators can implement; for example, administrators can deny well-known accounts at the global level for their FTP server. In addition, administrators can use one of the alternate built-in authentication providers instead of FTP’s Basic Authentication provider. For example, you can use the ASP.NET Membership Authentication provider; by using this provider, if an account was successfully hacked, that account will have no access to the actual server because it exists only in the ASP.NET Membership database.

In FTP 8, an extra layer of security was added that is called FTP Logon Attempt Restrictions; this feature provides an additional password lockout policy that is specific to the FTP service. Server administrators can use this feature of the FTP server to configure the maximum number of logon attempts that are allowed within a specific time period; once the number of logon attempts has been reached, the FTP service will disconnect the FTP session, and it will block the IP address of the client from connecting until the time period has passed.

Server administrators can configure the FTP Logon Attempt Restrictions feature in combination with their password lockout policies to configure a secure environment for their network, which allows uninterrupted functionality for valid users. For example, if you configured your FTP 8 server for a maximum of four failed logon attempts, you could configure your password lockout policy for a maximum of five failed logon attempts. In this way, a malicious FTP client would be blocked once it reached four failed logon attempts, and yet the valid user would still be able to access the account if he or she attempted to log on during the time period where the attacker was blocked.

Configuring FTP Logon Attempt Restrictions