I want to setup basic authentication on a virtual directory (in IIS6). It looks as if a malicious user can use the dialog (uid/pwd challenge) to try and login with a domain account and lock this account through failed attempts (so you could lock user and service accounts, which is not good). Is there a way around this behavior? I tried setting the default domain to the local machine and use a non - AD account, but this didn't help.
Thanx in advance!
You should try this addon: http://www.iis.net/download/DynamicIPRestrictions It will dynamically block IPs after x-number of failed logins.
This issue applies to any system, Windows or otherwise. I can create a simple program that will lockout every account on every AD domain in an organization, the impact would be huge, and it would be very difficult to recover from such an attack. The only thing required is a list of usernames/domains, which are available to anyone who logs on the network.
Simply put, if your passwords are so weak that they can be brute-forced, you're problem isn't account lockout.
Here are some perspectives from various sources at Microsoft:
"Bad Password Threshold is set too low: This is one of the most common misconfiguration issues. Many companies set the Bad Password Threshold registry value to a value lower than the default value of 10. If you set this value too low, false lockouts occur when programs automatically retry passwords that are not valid. Microsoft recommends that you leave this value at its default value of 10. "
Troubleshooting Account Lockout
http://technet.microsoft.com/en-us/library/cc773155%28v=ws.10%29.aspx
What should I set account lockout to?
"You should turn it off. Account lockout is a feature that locks out an account after a certain number of attempts to log on with an incorrect password. It is designed to protect the computer against weak passwords. The problem is that weak passwords will eventually fall to an attack anyway, regardless of account lockout. The smart attacker will simply modify the attack in such a way as to not trigger the account lockout. A weak password will resist longer against such an attack when account lockout is used, but it will still eventually be broken."
"In addition, account lockout makes it trivial for a less sophisticated attacker to disable the computer completely. A simple batch file can be used to lock out every account on the computer, thereby crippling it. Account lockout, while designed to protect against weak passwords, instead create a condition where a trivial denial of service attack is possible."
Frequently Asked Questions About Passwords
http://technet.microsoft.com/en-us/library/cc512606.aspx
Having a user account locked because of a malicious user is annoying. Having a user account compromised because of a malicious user is quite bad.
The better way to handle this is to set a policy to:
This way you can prevent both a malicious person to brute force your password and not bother too much a legitimate users that would have lock his account.
And service accounts should not be able to login through your web services but should be restricted to log only as tasks or services (this is also set using GPOs).
