23

Remote session from client name a exceeded the maximum allowed failed logon attempts. The session was forcibly terminated.

One of the servers are being hit by a dictionary attack. I have all the standard security in place (renamed Administrator, etc.) but want to know is there a way to limit or ban the attack.

Edit: The server is remote only. I need RDP to access it.

1
  • Protected question as its quite popular and gathering a few low-quality answers.
    – Rob Moir
    Dec 9, 2012 at 17:36

8 Answers 8

29

Block RDP at the firewall. I don't know why so many people allow this. If you need to RDP to your server, setup a VPN.

19
  • 3
    @EduardoMolteni: As Jason states, block RDP at the firewall and use a VPN.
    – GregD
    Sep 23, 2011 at 15:10
  • 5
    @Eduardo - The correct thing to do is VPN in. That would still give you the access you need. If you insist on allowing RDP access to your server, you do so at your own risk. There is no popular tool or method out there for limiting these attacks. Good sysadmins just block the traffic. If you'd like to give it a shot, maybe you can modify Evan's program here serverfault.com/questions/43360/… to look for RDP connections. I'm not sure if that's even an option but it's probably your closest chance.
    – Jason Berg
    Sep 23, 2011 at 15:14
  • 2
    @EduardoMolteni: You've gotten the wrong impression if you think we're "not nice people" or "mad" and if English isn't your first language, perhaps those aren't the first judgments you should come to? I just simply wondered why several people had mentioned setting up a VPN and you kept saying, "I need RDP to access it". You can still RDP through a VPN connection...
    – GregD
    Sep 23, 2011 at 16:14
  • 7
    Not sure why you are so extremely against permitting RDP. The encryption isn't that bad, the same as https. By setting up a VPN all you are basically doing is changing the object an attacker would need to brute force. If the VPN uses simple password authentication integrated into the same authentication system as the RDP host, then you really haven't changed much at all.
    – Zoredache
    Sep 23, 2011 at 16:21
  • 7
    I'm amazed that people would wrap one remote access service in another when there is so little benefit. VPN can be brute forced like anything else. Locking out accounts based on RDP attempts is just silly. Rather set up so 150 incorrect passwords from any given IP within 24 hours blocks that IP. If this is such a huge problem, don't use passwords.
    – Alex Holst
    Sep 23, 2011 at 20:40
11

Change the port and virtually all attacks will stop.

Attacks are usually not directed to you specifically but to all IPs. So they won't try non-default ports because it's simply not worth it; trying the next IP has chances orders of magnitude greater than trying the next port.

2
  • 19
    When being hunted by lion, you must only outrun the slowest gazelle to survive.
    – IslandCow
    Sep 23, 2011 at 16:35
  • The instruction on how to do it can be found at support.microsoft.com/kb/306759
    – mailq
    Sep 25, 2011 at 10:00
7

Theoretically you would accomplish this using a tool called an intrusion prevention system (IPS). Ideally this device would be an appliance outside of your Windows box. Building a rule in a Linux iptables firewall to block brute force traffic is pretty easy.

In a separate question Evan mentions he developed a script which would manage the Windows firewall based on failures in OpenSSH. You may be able to adapt his code to apply here, if you must do this on the Windows box itself.

4

The only thing I can think of why your server is getting hit with a massive amount of RDP attempts is that you can RDP to it from the internet. Disable this access from the internet and you should be fine. Use a VPN like everyone else if you need to RDP to the server from the outside. If these are internal attempts, then you have a bigger problem that likely involves somebody getting terminated for trying to dictionary attack an internal server...

6
  • or there's malware on the network.
    – gravyface
    Sep 23, 2011 at 14:58
  • I need to be able to RDP from the internet. Just want to limit so you can't try to login several times per second Sep 23, 2011 at 15:00
  • 1
    @Eduardo - It's already been said twice. Put something in between the Internet and this server. Be it VPN, an SSH tunnel, TS Gateway, etc. Hell, if you are concerned this is an automated attack resulting from port scan, move the RDP port to something less obvious. Sep 23, 2011 at 15:09
  • 2
    @EduardoMolteni: With VPN you can still RDP from the internet. Why do you keep glossing over the VPN part?
    – GregD
    Sep 23, 2011 at 15:11
  • @Aaron: Don't get mad. Just learning the options here. Sep 23, 2011 at 15:12
4

If you know the IP addresses of the PCs that need to RDP to this server over the internet, configure your router/firewall to only allow RDP traffic from those IPs or IP ranges. If the incoming PCs are on DHCP from their ISP, putting the ISP's IP range(s) in to your firewall would at least block most of the random login attempts.

2

You could change the port to a non-defaultRDP port. This will still allow you to connect but make it slightly harder for someone to find RDP on your machine.

http://support.microsoft.com/kb/306759

1
  • I have RDP setup on my home network... but I have it changed at the router to a non-standard port. was going to suggest at-least changing the ports, as I think that would thwart all but the absolutely most dedicated hacks.
    – WernerCD
    Sep 23, 2011 at 18:40
2

Ban the IP's using WinBan and the rdp mdule.

1

We use untangle to protect our network, and connect few remote locations. Simple setup on PC, quick install and configuration, fullness of firewall options, it comes with OpenVPN server.

Untangle Router

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .