27

Can anyone recommend a fail2ban-like tool for a Windows OS? I've got a couple of Windows Media servers that get hammered with brute force authentication attempts. I would like to plug these authentication failures into some kind of blocking tool.

  • Could you provide some clarification? What are you trying to accomplish? What version of Windows? Are you trying to block bad logins to PCs, network shares, Terminal Servers, IIS-hosted pages, etc? – Skawt Jun 18 '09 at 6:20
  • Clarified my question. – nurikabe Jun 18 '09 at 9:45
30

I know of no tool that will do this "out of the box". I wrote a script to do something like this with failed OpenSSH logons on Windows, but I can't share it with you because it "belongs" to the Customer for whom I wrote it.

Having said that, it was a simple VBScript program that had an event log sink to watch for new failed logons and, if enough happened in a time window, add an IP route (using the "route" command) to route traffic to the offending IP address to a "MS Loopback Adapter" on the system.

For other types of logs, it would be a fairly trivial matter to write. Since I didn't have IPtables on Windows, the loopback adapter seemed like the next best thing. (You can't do a "route x.x.x.x mask 255.255.255.255 127.0.0.1" on Windows-- you need an adapter to route the traffic to, because the 127.0.0.1 loopback isn't a "real" interface on Windows.)

(If you want something like this written, contact me out-of-band and we can discuss the specifics of such an arrangement.)

Edit:

I decided to write something to do this and I've released it under a Free license.

3

Check out this project - ts_block

I'm using it and thus far its terrific (Windows Server 2008 R2 RDS, system is behind a firewall but I didn't feel like using an ssl vpn gateway to the server)

1

wail2ban claims to be a Windows port of fail2ban

0

It doesn't look like fail2ban runs on windows at all, as it requires iptables which is only available on Linux.

However, I would suggest that you block everything and white-list only the IPs/names you want to be able to connect to the server(s) in question, if at all possible.

0

Another option that I've found is QaaSWall, I haven't tested it yet, but I will be in the next day or so.

  • Doesn't work on x64 actually, @Evan I'm using your script – Matt Bear Oct 18 '13 at 21:24
0

I found a tool called RdpGuard (https://rdpguard.com) that starts at $79 and appears like it might work. I haven't tested it yet, but might give it a go for my SMTP solution.

  • 1
    It would probably be a good idea to have used the product, before you make the recommendation. – Cory Knutson Jul 14 '17 at 19:35
  • A VM hosting company I started using includes a copy on their Windows VMs. It does the trick, and there are hundreds of firewall entries after just a few weeks. – atmarx Jan 8 at 12:05
0

You may check Win2ban which is a Fail2ban implementation for Windows systems. It is a packaging of Fail2ban, Python, Cygwin, Winlogbeat and many other related tools to make it a complete and ready-to-use solution for brute-force attack protection. A full functional free edition is available for non-commercial use.

NB! We are the developer of the solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.