Email Administrator on failed login

Question

Is there a way to have the server email me when there is a failed login? I have hundreds of hacking attempts and I'd like to know as soon as it happens. Thanks!

<--- Woot! I'm making progress!!!!

EDIT!!!

Let me clarify to you elitist administrators out there...

I am not behind a firewall nor can I afford one. I'm happy that you can but I cannot. This is 1 server. That's what I have. If you don't like the setup, then please move along.

I have had several attempts from various ips to try to log in to my server at approx 1000+ hits in a row until I block the ip.

I'm just looking for a way to catch this so it doesn't bog down my server again.

Answer 1

I'll propose an alternative solution rather than telling you how to put a band-aid on a broken arm.

It sounds like you have RDP open directly to the public internet. That's not good. To make this much more secure, you should:

1. Install a VPN Server on your box. RRAS, Direct Access, or even something like OpenVPN will do.

2. Once you can VPN onto a private subnet advertised by your server, turn RDP access off to the public internet by using the built in Windows Firewall.

After you've done this, only people that are logged into your VPN can access sensitive services like RDP. You can secure the VPN connection in a number of ways including username/password, smart card or other token, or certificate-based authentication.

You also say:

Let me clarify to you elitist administrators out there...

I am not behind a firewall nor can I afford one. I'm happy that you can but I cannot. This is 1 server. That's what I have. If you don't like the setup, then please move along.

It really isn't a matter of money. You can do everything that I just mentioned for free. You should take the time to learn how these services work and implement proper hardening for your server rather than flooding your phone with hundreds of email alerts throughout the day.

I'm just looking for a way to catch this so it doesn't bog down my server again.

It shouldn't bog anything down. 1000 failed logon attempts over the course of a minute is only ~17 requests a second. Those logon attempts have very little traffic associated with them. If these are, indeed, causing performance issues - then you have a different problem.

Answer 2

Here's the simplest solution I can offer you:

1. Go buy a simple Linksys router. It sounds like you won't have that much load if 1000 logon attempts is a lot. If you want you can even flash most of them with DD-WRT which will give you a lot more control over the box.

2. Then setup a Terminal Services Gateway on the box, this will provide a RDP over HTTPS session which will kill most of the RDP connection attempts. All you need is an SSL cert, worst case it can be self signed, you just need to load it on whatever client is going to connect, kinda like a SSH key.

3. Port forward only 443 to the box from your new Linksys router.

No need to bother with all of those e-mails or trying to block a specific IP. Just get a simple box to do it. At most your out of cost expense on this is $70-$80. Hopefully that is affordable.