FTP Brute-Force Protection

• FTP brute-force protection overview
• How to enable FTP brute-force protection

RdpGuard protects your FTP server from brute-force attacks.

It monitors FTP server logs or unencrypted FTP traffic and blocks the attacker's IP address when the number of failed login attempts reaches the configured limit.

1. Open RdpGuard Dashboard and click FTP under Monitored protocols.

   

2. Select Enable FTP protection, choose a monitoring method and configure it as described below. Then click Save.

   

Monitoring method for FTP

Choose how RdpGuard detects failed FTP login attempts:

• Logs - read supported FTP server logs.
• Traffic - monitor unencrypted FTP traffic.

Log-based monitoring

Logs is the recommended default method. It reads supported FTP server logs and uses fewer resources than Traffic. SSL/TLS connections (FTPS) and username detection are supported.

FTP server

Select the server software installed on this computer:

• Microsoft IIS
• FileZilla
• Axigen Mail Server (FTP-Backup)
• SolarWinds SFTP/SCP
• Serv-U

Log location

Make sure server logging is enabled, then specify where RdpGuard should read the logs:

• Microsoft IIS: click Add... to add one or more FTP log folders, for example C:\inetpub\logs\LogFiles\FTPSVC1.
• Axigen: select the security.txt file, usually in C:\Program Files\Axigen Mail Server\log.
• FileZilla, SolarWinds SFTP/SCP and Serv-U: select the server's log folder.

Click Save to apply the settings.

Traffic-based monitoring

Traffic detects failed logins in unencrypted FTP traffic without reading server logs. It uses more resources than Logs and does not detect usernames. For encrypted FTP connections (FTPS), use Logs instead.

Select Traffic, then choose a capture method:

• WinPcap/Npcap (recommended) - install WinPcap or Npcap, then click Configure... to select the network adapter to monitor.
• Raw Sockets - may affect network performance and may not work with some firewalls or Windows editions.

FTP ports

Leave this field empty to monitor port 21, or enter the ports used by your FTP server. Separate multiple ports with commas, for example 21, 2121.

Click Save to apply the settings.