How to set up on blocking IP on FTP attacks

[waldemarvulf]

Hello all.
Is it possible to configure the blocking of IP attacking FTP server?
If so, could anyone tell me how to do this?

I apologize if this is a stupid question. I'm not very experienced in this.
Thanks in advance.

[jjxtra]

Of course. Anything that writes to a log file on Windows or Linux can be blocked. The windows event viewer can also be used.

[waldemarvulf]

If I understood correctly, then this is configured in a configuration file.
But, as I understand it, in this group there is already a record of blocking by event 4625.

RDP
0x8010000000000000
Security

    <!-- Override failed login threshold or leave 0 for default -->
    <FailedLoginThreshold>0</FailedLoginThreshold>

	<!-- Optional, set a log level, must match exactly (case sensitive) one of the following:
	Trace, Debug, Info, Warn, Error, Critical
	<LogLevel>Warn</LogLevel>		
	-->		
	
    <Expressions>
      <Expression>
        <XPath>//EventID</XPath>
        <Regex>^(4625|5152)$</Regex>
      </Expression>
      <Expression>
        <XPath>//Data[@Name='IpAddress' or @Name='Workstation' or @Name='SourceAddress']</XPath>
        <Regex>
          <![CDATA[
            (?<ipaddress>.+)
          ]]>
        </Regex>
      </Expression>
      <Expression>
        <XPath>//Data[@Name='ProcessName']</XPath>
        <Regex>
          <![CDATA[
            (?<source_IIS>c:\\Windows\\System32\\inetsrv\\w3wp.exe)?$
          ]]>
        </Regex>
      </Expression>
    </Expressions>
  </Group>

According to the RDP, the protocol blocking the iPs works perfectly, but does not work on FTP for the same event 4625. I can’t understand what needs to be added, changed in the configuration file.

[jjxtra]

Can you post the event viewer xml from your ftp? Please mask out any sensitive info.

[waldemarvulf]

I tried it to connect obviously with the wrong login and password to my ftp. For some reason, the IP address is not determined in the even viewer.

4625 0 0 12544 0 0x8010000000000000 905382 Security Compi8 S-1-5-18 Compi8$ WORKGROUP 0x3e7 S-1-0-0 999 0xc000006d %%2313 0xc0000064 8 Advapi MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Compi8 - - 0 0xbf0 C:\Windows\System32\svchost.exe - -

[jjxtra]

If you can export this as raw xml it will be much easier to decipher

[jjxtra]

What ftp program are you using?

[waldemarvulf]

I use standard tools windows.
ftptry.txt

[jjxtra]

The ip logged by your ftp program is -. So IPBan cannot determine what ip to ban.

[jjxtra]

Does this recipe work?

https://github.com/DigitalRuby/IPBan/blob/master/Recipes/Windows/LogFile/IIS_FTP.xml

[waldemarvulf]

I copied this code and paste it into the configuration file, rebooted the computer, but it does not seem to work. I tried to connect many times with incorrect data, does not block.

[jjxtra]

Can you email your ipban.config and iis ftp log file to [email protected]?

[waldemarvulf]

yes, sure. Thank you.

[waldemarvulf]

Hello Jeff. I finally tested ip ban for ftp and it works. The only thing is that there is some delay when blocking, i.e. with many incorrect connection attempts, blocking does not occur immediately, but after some time.

However, I want to thank you very much for your time and help.