Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I administer a Windows Small Business Server 2003 R2 server for a small business. The only ports that this server has exposed to the internet are SSL and the RDP tunnelling port used by the SBS remote web workplace feature.

I've noticed in the security event log that there are times where there are a bunch of login failure events - which looks like someone hammering the server with various username/password combinations. Since SSL is the only port where one can do a login, I'm guessing they are hammering away at either SBS remote web workplace, Exchange OWA or Exchange Activesync.

We currently have just a linksys router (with aftermarket firmware), so I was thinking of getting a business grade firewall / UTM appliance - specifically a Sonicwall TZ 100. However, its my understanding that most UTM's can't secure HTTPS traffic, so I'm not sure if it would help in this case?

Is there something out there that can detect a string of login attempts all coming from the same IP and then block it?

Thanks

share|improve this question
add comment

1 Answer

i think you are looking for something comparable to fail2ban or denyhosts, which provide similar functionality on nix.

see this and this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.