Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I know that good policy require complex passwords, change passwords every few days, etc. .. but have a system that, after 5 wrong attempts (for example) block the account for 1 hour, it helps to have a greater security against these attacks. What I ask is if there is that kind of protection.

Thank you

share|improve this question

3 Answers 3

up vote 1 down vote accepted

IIS doesn't; Windows does. Unless you've implemented a non-Windows account provider, a Basic logon attempt hits a Windows user account, and works in conjunction with Windows password policy.

share|improve this answer

To protect against brute force attacks, slow down the response in case of unsuccessful authentication, use long hard to guess passwords. Mandatory use SSL (https).

share|improve this answer

Hmmm... some circular logic going on here. You've configured your web site to use basic authentication, presumably to authenticate the users accessing the site and to keep unauthenticated users out but it's blocking too many login attempts? Isn't that the purpose of authentication? To allow authenticated entities and disallow unauthenticated entities?

Am I misunderstanding your question (probably, based on it's form)? Are you asking if basic authentication is a default setting in IIS? If so, the answer is no.

share|improve this answer
    
I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I know that good policy require complex passwords, change passwords every few days, etc. .. but have a system that, after 5 wrong attempts (for example) block the account for 1 hour, it helps to have a greater security against these attacks. What I ask is if there is that kind of protection. I apologize for my bad English, it is also because of what I find it hard to present clear –  Matteo Mar 30 '11 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.