Preventing attacks on FTP server

[Daveyd123]

I have an FTP site setup through IIS. My FTP site sits on the inside of the firewall and I have one of our public IPs NATd.

I have setup AD users with appropriate ACLs to be able to access the FTP externally, which they can.

Looking at my FTP logs over the past couple of days, it has shown that several IP addresses located in Korea have tried to access the FTP site using brute force. The logs shows 1000+ login attempts using the username "admin", "ftpuser" and "administrator", EVERY second from midnight to 6am.

If I indeed had actual accounts listed above, the would constantly be locked out.

I was thinking about restricting IP addresses on the server but that would be quite an undertaking as we have hundreds of people accessing the site.

Is there any way to avoid this type of attack? Would it have to be done one the server or firewall side?

 

[itsp1965]

As a start have you tried blocking the address ranges for the IP addresses based in Korea? If the FTP server is to be publicly accessed then it's kinda hard to stop people from accessing it. If FTP is not required from the outside, try blocking FTP on your router/firewall.

 

[Daveyd123]

The server has to be accessible externally.

I was thinking about trying to restrict IPs to just the United States. But, that still doesn't prevent someone trying to launch a brute force or dictionary attack on it.

 

[itsp1965]

Well you may want to consider implementing some sort of Host based Intrusion Detection software which will look for brute force attacks otherwise the more expensive solution is to put an IDS device on your network.

 

[Daveyd123]

We have an ASA 5510 with an IPS module. I have to check that out to see what I can do on it to prevent the attacks