This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG rdp brute force protction

Hi all

I am enjoying the xg firwall of sphos (SFVH (SFOS 15.01.0 MR-1.1)), really great so far !

a lot is clear and works very well, a few things I cannot find or do not know how to get it right. but sure it will come

But this one I would like to ask here, I have found the bruteforce protection for ftp, but can't find it for RDP

or can I make a own IPS package to protect my windows 7 RDP (3389) pc ?

best regards

Jeroen

This thread was automatically locked due to age.

0 lferrara over 8 years ago

Jeroen,

the best way to protect from RDP is to deny RDP at all from external. Instruct your users to use VPN and then once they are connected, use the RDP protocol.

https://support.microsoft.com/en-us/kb/2868725

RC4 is crackable and TLS 1.0 is vulnerable. Best security practices says "disable RDP from external" ans use VPN connections instead.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeroenhuisveilig over 8 years ago in reply to lferrara

Hi

thanks for the explanation I will consider it.

but if I need connection to my system from example my work pc I can not install any software, or if I am at my friends place to leave software behind.

but sure it is better then strange people try to get in, for sure I will use the GEO block.

thanks

jeroen
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to Jeroenhuisveilig

Jeroen,

you can setup L2TP/IPsec on your XG and connect to your Environment without installing any third party sw on your friend pc (windows has l2tp/ipsec built-in).

Also you can use User Portal and bookmarks.

[;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeroenhuisveilig over 8 years ago in reply to lferrara

Hi Luk

ok for sure i will try this.

but can I assume it is not possible to protect the rdp pc with the xg ips function ?

regards

jeroen
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeroenhuisveilig over 8 years ago

Hi

ahhh I have found the: Appendix B – IPS - Custom Pattern Syntax ( and the rest of the manual :))

I start really loving this firewall.

I have found on some sites some info I will try as ips signiture in the xg.

it is NOT tested but this is what I found and translated to the xg: content:"|e0|";distance:5;within:1;dstport:3389;flow:from_client;seq:1;offset:1;

I only miss what I can use for the rate limit then it should be complete.

I will go further discover the XG

any tips around this are still very welcome

Jeroen
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to Jeroenhuisveilig

Jeroen,

XG allows to create custom IPS rules. The appendix has all the info to create custom one. Let us know if you are able to create RDP - Brute force IPS rule and share it.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeroenhuisveilig over 8 years ago in reply to lferrara

Hi,

sure I will if you can give me more info about tcp rate limit it could be a succes. I am not a certified tcp ip expert so ...

so far nothing special happend

Jeroen
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeroenhuisveilig over 8 years ago in reply to Jeroenhuisveilig

HI

I tested the portal clientless and works fine ( also trough proxy !)

great alternative, full screen would be more cool, but no this is very fine.

Jeroen
Cancel
Vote Up 0 Vote Down

Cancel