Quote: "If your account manager is worth it's salt it will dissable or time out the account after 3 wrong guesses anyway"
I've thought about that a little and it doesn't seem like good protection to me:
- it'd be a great DOS attack. Simply attempt to log into all known accounts, deliberately getting the password wrong until it is locked. When someone locks out administrator, you are no longer in control of your machine.
- you can't lock an account that doesn't exist, so once you get a locked account, you know it's a valid one.
Better ideas for protection:
- Delay after a failed login attempt (invalid user or incorrect password). Slows down retries.
Don't report 'incorrect password' or 'invalid user' - just 'login failed', and only immediately before disconnect. If you report then delay, the attackers code can detect that and disconnect early, then try again immediately.
- When you hit a threshold for number of connections per second/minute/hour from an IP, slow them right down.
- Don't block IP's - so many people use common gateways that you can block your legitimate users along with your attackers. Again, just slow them down.
Most of these are based upon slowing down the attacks, not stopping them. Brute-force is a numbers game which you can win just by slowing everything down to a point where an attack will be stretched to years instead of minutes.
@xplosys,
I'm not aware of anything for windows that does what you need. Switch to linux instead
