1

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I know that good policy require complex passwords, change passwords every few days, etc. .. but have a system that, after 5 wrong attempts (for example) block the account for 1 hour, it helps to have a greater security against these attacks. What I ask is if there is that kind of protection.

Thank you

0

3 Answers 3

1

IIS doesn't; Windows does. Unless you've implemented a non-Windows account provider, a Basic logon attempt hits a Windows user account, and works in conjunction with Windows password policy.

1

To protect against brute force attacks, slow down the response in case of unsuccessful authentication, use long hard to guess passwords. Mandatory use SSL (https).

0

Hmmm... some circular logic going on here. You've configured your web site to use basic authentication, presumably to authenticate the users accessing the site and to keep unauthenticated users out but it's blocking too many login attempts? Isn't that the purpose of authentication? To allow authenticated entities and disallow unauthenticated entities?

Am I misunderstanding your question (probably, based on it's form)? Are you asking if basic authentication is a default setting in IIS? If so, the answer is no.

1
  • I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I know that good policy require complex passwords, change passwords every few days, etc. .. but have a system that, after 5 wrong attempts (for example) block the account for 1 hour, it helps to have a greater security against these attacks. What I ask is if there is that kind of protection. I apologize for my bad English, it is also because of what I find it hard to present clear
    – Matteo
    Mar 30, 2011 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .