4 ms·

Blunting RDP brute-force attacks with rate limiting

16 points by Sami_Lehtinen 5y ago

DougN7 5y ago
RDPGuard does a good job at this. I have no affiliation other than as a user.
prdonahue 5y ago
Alternatively, you could just run Cloudflare Access and use stronger auth without having to worry about rate limiting: https://developers.cloudflare.com/cloudflare-one/tutorials/rdp/ https://developers.cloudflare.com/cloudflare-one/tutorials/r....
- stevenicr 5y ago
  I guess sure - if you are cool with supporting an org that is inspecting what you and your users do on many web sites that is also proactively sending info about things they don't like to agents with guns while they continue to increase their monopoly of mitm across much of the web - yeah use them to solve all your problems.
SturgeonsLaw 5y ago
Rate limiting needs to take into account password spray attacks. Instead of iterating through a series of passwords for a given username, an attacker can iterate through a series of usernames for a common password. Under a lot of rate limiting systems (including the default settings for RDP I believe) this will only count as one attempt on each user.
- justsomehnguy 5y ago
  > including the default settings for RDP I believe There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local accounts) or the domain. Default AD DS settings are pretty lax, but whoever runs the open RDP with a default security settings deserves what would happen to him. > this will only count as one attempt on each user Yes, because the lockout policies are applied for user accounts, not for source IPs. Though it can be mitigated with a couple of scripts, if needed.
justsomehnguy 5y ago
Why even bother with rate-limiting if you can just ban the offending address? If someone makes 10-9999 attempts to auth in the last 10 minutes just cut them off. Even a 15 minutes ban would makes most of the bots to go away. Make the ban longer (couple of hours is enough but you can use 24h or more, if you are paranoid) and you will never see the same bot again. You can do it even with a simple PowerShell script. Of course the best method would be to not to expose the RDP at all (RCE is still a thing) but...

16 points by Sami_Lehtinen 5y ago

RDPGuard does a good job at this. I have no affiliation other than as a user.

Alternatively, you could just run Cloudflare Access and use stronger auth without having to worry about rate limiting: https://developers.cloudflare.com/cloudflare-one/tutorials/rdp/ https://developers.cloudflare.com/cloudflare-one/tutorials/r....

stevenicr 5y ago
I guess sure - if you are cool with supporting an org that is inspecting what you and your users do on many web sites that is also proactively sending info about things they don't like to agents with guns while they continue to increase their monopoly of mitm across much of the web - yeah use them to solve all your problems.

SturgeonsLaw 5y ago

Rate limiting needs to take into account password spray attacks. Instead of iterating through a series of passwords for a given username, an attacker can iterate through a series of usernames for a common password. Under a lot of rate limiting systems (including the default settings for RDP I believe) this will only count as one attempt on each user.

justsomehnguy 5y ago
> including the default settings for RDP I believe There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local accounts) or the domain. Default AD DS settings are pretty lax, but whoever runs the open RDP with a default security settings deserves what would happen to him. > this will only count as one attempt on each user Yes, because the lockout policies are applied for user accounts, not for source IPs. Though it can be mitigated with a couple of scripts, if needed.

justsomehnguy 5y ago

Why even bother with rate-limiting if you can just ban the offending address? If someone makes 10-9999 attempts to auth in the last 10 minutes just cut them off. Even a 15 minutes ban would makes most of the bots to go away. Make the ban longer (couple of hours is enough but you can use 24h or more, if you are paranoid) and you will never see the same bot again. You can do it even with a simple PowerShell script. Of course the best method would be to not to expose the RDP at all (RCE is still a thing) but...