Security – Create a Lockout policy for RDP

active-directorygroup-policyrdpSecuritywindows-server-2008

In my city there was a recent incident that some hackers login to a server by using brute force attack on RDP. I have got a server and I want to enable some security policy to lockout the account if more than 3 constitutive unsuccessful attempts occurs. I have not idea how to implement it?

Could someone please show me the correct direction?

Thank you!

Best Answer

You're thinking about this the wrong way around. RDP should not be accessible from the Internet. Ever.

But... you can specify the number of failed logon attempts before that user account is locked out using local security policy (Security Settings - Account Policies - Account Lockout Policies). However if I recall correctly Account Lockout Policies are not applied to the local administrator account.

Related Solutions

Proving Password Security to Non-Mathematicians – Standard Methods

Using fail2ban with the iptables is a great way.

Here is the math for you:

Mixed upper and lower case alphabet and common symbols, 8 characters long, gives you 2.9 quadrillion conbinations and with 10,000 attempts a second will take 9,488 years. Thats the maximum of course - expect your password to be cracked in 4000 years. 1000 years if you're not feeling lucky.

As you can see you shouldn't have any issues if you do a 15 character password like:

dJ&3${bs2ujc"qX

How to secure Outlook Web Access against Brute Force attack

That's good enough if you have a reasonable password policy. If people can have a password of 1, that's probably going to be a problem.

You've rate limited brute forcing the password to 1 password every 2 minutes. At that rate guessing a 7 character, all numbers password would take 19 years of straight hacking on average... and that's a pretty crappy password.

Best Answer

Related Solutions

Proving Password Security to Non-Mathematicians – Standard Methods

How to secure Outlook Web Access against Brute Force attack

Related Topic