Log monitoring security software

[brokenhalo]

Hello all:

My servers have been impacted by some annoying brute force attacks. I am running win server 2k8. On my CentOS servers I run apf/bfd which is contantly running through the logs, and after so many failed login attempts it blocks their IP address. I am wondering if anyone knows of any Windows based software that can essentially do the same thing, and block some of these people after so many failed login attempots so I don't have to manually do it. Thanks in advance!

Brad L.
Systems Engineer
Prestige Technologies
bradlaszlo[at]prestigetech.com

http://www.prestigetech.com

"Some things Man was never meant to know. For everything else, there's Google.

 

[gbaughma]

Without installing additional software, the "3 strikes and your out" rule on the logins helps.

Or, less annoying (so you don't have to manually unlock accounts) you can have the accounts re-activate after, say, 2 hours.

... or just hunt down the perp and kill them.

I found that finding their IP, then calling their ISP and reporting the abuse works, too.



Just my 2¢

"What the captain doesn't realize is that we've secretly replaced his Dilithium Crystals with new Folger's Crystals."

--Greg

http://parallel.tzo.com

 

[brokenhalo]

I'm sorry, I guess I should clarify a bit better. The perpetrators are attempting to brute force things like ftp and microsoft sql (sql doesnt have an account lockout policy that I'm aware of and doesn't use Windows accounts for logon), which is why I'm asking if there is any software out there to do this for me. Thanks!

Brad L.
Systems Engineer
Prestige Technologies
bradlaszlo[at]prestigetech.com

http://www.prestigetech.com

"Some things Man was never meant to know. For everything else, there's Google.