I've configured a PPTP VPN in a small company which so far is running well. In the VPN logs, they've found several logs of attempted connections from unkwoun users, one attempted connection every second during a few minutes. Standard names were used like helpdesk, anyuser, interface and so on. The VPN server and router firewalls are enabled. There are only a few users with strong passwords with provileges to connect to the VPN. IP range is also defined. Is there any other security measures that could be taken? Thanks!

  • 2
    You might want to reconsider the use of PPTP. Given a packet capture, breaking the encryption is fairly easy with chapcrack. – Scott Leadley Aug 11 '14 at 20:38

As @ChristopherPerrin said, it's the background noise of the internet. Scripts and bots are constantly scanning the internet, doing the equivalent of jiggling door handles looking for ones that are unlocked or poorly locked. I do however disagree that there is nothing you can do about it.

Use those logs to block them at the firewall level. On linux I use fail2ban do to this. There may be similar solutions for windows, or you could write your own script to do it.

There are a few reasons for doing this:

  • Even if you have strong passwords, given an infinite number of guesses, they will get in. If you don't enforce strong passwords, eventually John Smith will change his password to "password". Blocking them gives them a limited number of guesses.

  • Firewalls can drop the traffic using far less system resources. It's not a big deal when one bot is scanning you. But if 30 of them all decide to hone in on your server at once, it can slow down authentication or VPN traffic in general for all the legitimate users. By blocking them at the firewall level, the scripts usually get the hint and move on to the next target quickly.

  • You can block them from other resources at the same time. Fail to login to the VPN 20 times in the last 5 minutes? Block them from the entire network so they can't keep scanning other services for vulnerabilities. Fail to login to the website 20 times in the last 5 minutes? Blocked from everything, including the VPN. Make the number of failures allowed and the length of the ban as lax as you need to for it to not regularly affect real users.

  • It limits the amount of spam in your logs, so you can see real problems that you otherwise wouldn't notice.

The way fail2ban works is to watch the log files, and when it sees 5 failed login attempts from the same IP address within 5 minutes, it runs an iptables command to add a firewall rule blocking them for 30 minutes. After the ban expires it removes that firewall rule. The numbers are configurable, as are the actions.

You may also want to set a few addresses that it will NEVER block, no matter how many failed tries there are - like your local LAN, or some public addresses of servers you control, so there's no risk of you being locked out.

  • Thanks Grant for your detailed suggestions! The server use Windows, but I will try to implement some of them. – user1421676 Aug 11 '14 at 13:42

It is normal that unknown users try to connect with standard usernames. You can view it as the noise of the internet.

If you have strong passwords there is no need to worry. Take it as it is and keep your software updated. There is about nothing you can do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.