Somebody trying Password guessing thru the ftp 2

[marslove]

Somebody trying Password guessing thru the ftp. Does anybody knows how to block those attempts on Cisco router?
Thanks

 

[drewdown]

ACL to block all FTP requests?

Need a little more information though.

 

[burtsbees]

Windows? Download Solaris 10 for x86 (free) and install it on a junker---UNIX is better. The free FTP service in UNIX can be configured for non-anonymous access.

Burt

 

[marslove]

FTP Box Windows behind Cisco router, I used port mapping to the FTP Box. Somebody doing BRUT FORCE attack throe port 21. Temporary disabled mapping till find remedy

Thanks

 

[burtsbees]

They will brute force no matter what---kids from the University of Beijing, China (or a server there being used as a proxy) usually. Just make a strong password, and turn it off when you don't need it. Or, make the port mapping use a different port, like 2121. You could make acl's in the router to allow only certain people, but if anyone has access, then that won't work. Also, there is CAR/policy maps to limit bandwidth for FTP. I turn mine off during the day myself---not too worried about it. Not much on the ftp server, and acl's to block everyone from hopping from the ftp server to anywhere else in my network.

Burt

 

[Dannno]

I read an article a while back about how North American companies are beginning to block IPs that originate from hostile countries (internet-wise) so I did the same thing. My company is based solely in North America and has no dealings with China, Korea, Vietnam, Germany etc.. so we have no reason to allow access from those areas of the world. I found a site that lists each country's IP blocks and turned it into an ACL and threw it on our router that sits in front of our firewall.

The port scanning virtually disappeared while watching the PIX realtime log. The ACL on the router is very revealing .. after a month some of the deny statements had over half a million hits.

Obviously this isn't a solution for everyone but it works great for us. I put it on all of our edge routers throughout the company. Later!

Dan

 

[burtsbees]

I did that at one time, until I could get to Gogle anymore! I went to dns-stuff.com to get the IP block from the attacker, and blocked the whole thing. It worked for like 20 blocks, then suddenly Google was in one of those blocks...lol

Burt

 

[bobbyforhire]

Wait...you have a PIX? You could just turn on the IDS in your pix. Or if you wanted to you can turn off ICMP as when they are searching for a server they will ping it first to see if it's there.

If you are using a 3rd party ftp application for your FTP Server i'm sure they have a brute force blocker type deal.
Yeah thats a tech term for ya!