Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these authentication failures into some kind of blocking tool.

share|improve this question
    
Could you provide some clarification? What are you trying to accomplish? What version of Windows? Are you trying to block bad logins to PCs, network shares, Terminal Servers, IIS-hosted pages, etc? –  Skawt Jun 18 '09 at 6:20
    
Clarified my question. –  nurikabe Jun 18 '09 at 9:45

5 Answers 5

up vote 23 down vote accepted

I know of no tool that will do this "out of the box". I wrote a script to do something like this with failed OpenSSH logons on Windows, but I can't share it with you because it "belongs" to the Customer for whom I wrote it.

Having said that, it was a simple VBScript program that had an event log sink to watch for new failed logons and, if enough happened in a time window, add an IP route (using the "route" command) to route traffic to the offending IP address to a "MS Loopback Adapter" on the system.

For other types of logs, it would be a fairly trivial matter to write. Since I didn't have IPtables on Windows, the loopback adapter seemed like the next best thing. (You can't do a "route x.x.x.x mask 255.255.255.255 127.0.0.1" on Windows-- you need an adapter to route the traffic to, because the 127.0.0.1 loopback isn't a "real" interface on Windows.)

(If you want something like this written, contact me out-of-band and we can discuss the specifics of such an arrangement.)

Edit:

I decided to write something to do this and I've released it under a Free license.

share|improve this answer

Check out this project - ts_block

I'm using it and thus far its terrific (Windows Server 2008 R2 RDS, system is behind a firewall but I didn't feel like using an ssl vpn gateway to the server)

share|improve this answer

Are you looking for failures via a website, or local (i.e. Active Directory) failures? If from the web, what are you using for your firewall solution? I've always done this from within the application itself.

share|improve this answer
    
Actually, it would be for a couple of Windows Media Servers. I'm looking for a way to plug authentication failures into some kind of IP blocking tool / API-enabled firewall. –  nurikabe Jun 18 '09 at 9:43

It doesn't look like fail2ban runs on windows at all, as it requires iptables which is only available on Linux.

However, I would suggest that you block everything and white-list only the IPs/names you want to be able to connect to the server(s) in question, if at all possible.

share|improve this answer

Another option that I've found is QaaSWall, I haven't tested it yet, but I will be in the next day or so.

share|improve this answer
    
Doesn't work on x64 actually, @Evan I'm using your script –  Matt Bear Oct 18 '13 at 21:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.