Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to have the server email me when there is a failed login? I have hundreds of hacking attempts and I'd like to know as soon as it happens. Thanks!

<--- Woot! I'm making progress!!!!

EDIT!!!

Let me clarify to you elitist administrators out there...

I am not behind a firewall nor can I afford one. I'm happy that you can but I cannot. This is 1 server. That's what I have. If you don't like the setup, then please move along.

I have had several attempts from various ips to try to log in to my server at approx 1000+ hits in a row until I block the ip.

I'm just looking for a way to catch this so it doesn't bog down my server again.

share|improve this question
4  
So you want hundreds of email notifications? –  Ryan Bolger Jul 6 '12 at 15:53
    
Windows logon failures are already logged; you can view them through Event Viewer → Windows Logs → Security. Why do you want to use, instead of an existent log mechanism, an email delivery, which was never designed for logs? –  MainMa Jul 6 '12 at 15:56
    
I don't log on to my server daily. If they are attempting to hack me, I want to know right away and get an email so I know to get in and block that ip. If I am only able to monitoring the event viewer, that means I need to stay logged in all the time and I cannot do that. –  ErocM Jul 6 '12 at 16:10
1  
Use the built in firewall. Better than nothing. –  t1nt1n Jul 6 '12 at 16:51
2  
@ErocM Check out this Answer from Evan Anderson who wrote a script that will automatically take those Failed Login events an block the IP in the Windows Firewall. –  Chris S Jul 6 '12 at 17:27

2 Answers 2

up vote 6 down vote accepted

I'll propose an alternative solution rather than telling you how to put a band-aid on a broken arm.

It sounds like you have RDP open directly to the public internet. That's not good. To make this much more secure, you should:

  1. Install a VPN Server on your box. RRAS, Direct Access, or even something like OpenVPN will do.

  2. Once you can VPN onto a private subnet advertised by your server, turn RDP access off to the public internet by using the built in Windows Firewall.

After you've done this, only people that are logged into your VPN can access sensitive services like RDP. You can secure the VPN connection in a number of ways including username/password, smart card or other token, or certificate-based authentication.

You also say:

Let me clarify to you elitist administrators out there...

I am not behind a firewall nor can I afford one. I'm happy that you can but I cannot. This is 1 server. That's what I have. If you don't like the setup, then please move along.

It really isn't a matter of money. You can do everything that I just mentioned for free. You should take the time to learn how these services work and implement proper hardening for your server rather than flooding your phone with hundreds of email alerts throughout the day.

I'm just looking for a way to catch this so it doesn't bog down my server again.

It shouldn't bog anything down. 1000 failed logon attempts over the course of a minute is only ~17 requests a second. Those logon attempts have very little traffic associated with them. If these are, indeed, causing performance issues - then you have a different problem.

share|improve this answer
    
That's great! I'll start researching this more. –  ErocM Jul 6 '12 at 17:05

Here's the simplest solution I can offer you:

  1. Go buy a simple Linksys router. It sounds like you won't have that much load if 1000 logon attempts is a lot. If you want you can even flash most of them with DD-WRT which will give you a lot more control over the box.

  2. Then setup a Terminal Services Gateway on the box, this will provide a RDP over HTTPS session which will kill most of the RDP connection attempts. All you need is an SSL cert, worst case it can be self signed, you just need to load it on whatever client is going to connect, kinda like a SSH key.

  3. Port forward only 443 to the box from your new Linksys router.

No need to bother with all of those e-mails or trying to block a specific IP. Just get a simple box to do it. At most your out of cost expense on this is $70-$80. Hopefully that is affordable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.