RdpGuard Plugin API

Use the RdpGuard Plugin API to detect failed login attempts in application logs that RdpGuard does not support natively. Your plugin parses log entries; RdpGuard monitors the files, counts failed attempts and blocks IP addresses according to your settings.

Create a .NET Framework class library and add a reference to rdpguard-plugin-api.dll from your RdpGuard installation folder. The API and sample plugin target .NET Framework 4.5.

Implement IExternalLogBasedEngine in a public class with a parameterless constructor. The sample below gets this constructor automatically because it does not declare any constructors.

Place your plugin in the Plugins folder inside the RdpGuard installation folder, for example C:\Program Files\RdpGuard\Plugins.

The plugin interface is below:

namespace rdpguard_plugin_api {

    public interface IExternalEngine {

        string Name { get; }
        string Protocol { get; }
    }

    public interface IExternalLogBasedEngine : IExternalEngine {

        string Directory { get; }
        string FileMask { get; }

        bool IsFailedLoginAttempt(string _line, out string _ip, out string _username);
    }
}

Return true for a failed login attempt and set _ip to a valid IP address. Set _username to null if the log does not include a user name. Return false for other log entries.

The sample implementation:

using rdpguard_plugin_api;

namespace rdpguard_test_plugin {

    public class MyEngine : IExternalLogBasedEngine {

        public string Name => "TestEngine";
        public string Protocol => "MyProto";

        public string Directory => @"C:\MyApp\Logs\";
        public string FileMask => "*.log";

        public bool IsFailedLoginAttempt(string _line, out string _ip, out string _username) {

            _ip = _username = null;

            // sample log line:
            // 2020-06-22 10:29:18 AUTH-ERROR admin 66.249.65.238 Invalid+username+or+password

            var parts = _line.Split(' ');

            if (parts.Length > 5 && "AUTH-ERROR" == parts[2]) {
                _username = parts[3];
                _ip = parts[4];
                return true;
            }

            return false;
        }
    }
}

Build your plugin and copy the resulting DLL to C:\Program Files\RdpGuard\Plugins (or the Plugins folder in your chosen installation directory). Create the folder if necessary, then restart the RdpGuard service using Tools, RdpGuard Service, Restart.

Select Verbose logging in Tools, Options, Logging and click Save before restarting the service. Look for this message in the log:

ExternalLogBasedEngine::TestEngine started (C:\MyApp\Logs\)

This message confirms that the plugin has started. To test detection, generate new failed login attempts in your application and check that RdpGuard records them.

Feel free to contact us if you need any help with your plugin.