[quoted text, click to view]


The best answer seems to be to create a long (secure) administrator
password, and check that your FTP server implements a delay on responding to
failed password attempts, so that the attacker can't try many passwords per
second. With a sufficiently long password (throw four or five words
together), it won't even matter if the delay isn't present, the attacker
simply isn't likely to hit the right password in his lifetime.

Note that if you run a server on the public Internet, you will _always_ have
people trying to connect to it using their own choice of authentication -
user names and passwords, etc. This is mostly just a sign that there are
large numbers of malicious people out there, and your server will just plain
have to deal with it.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.

On Mar 12, 3:54 pm, mdhairil <mdhai...@discussions.microsoft.com>
[quoted text, click to view]

I'm not sure if IIS supports this, but another approach is to block
the IP after too many unsuccessful attempts v.s. shutting down the
account. This way you don't have the problem of a user locking out an
account ... instead access from that IP is just blocked altogether.
The server we use here supports this option ( http://www.jscape.com/secureftpserver/
) ... coupled with an email notification when an attacker is blocked
works well for us.