Forum Discussion
Nimbostratusirule Brute Force attack control on SFTP Virtual servers
How do you guys normally deal with Brute Force attack on non HTTP traffic? I can perhaps set up an irule to limit the number of connection by the same IP address, but is there a way to detect how many connections are coming from the same IP address in x seconds, and if it exceeds that amount of connection, block the IP for 10 minutes?
1 Reply
- boneyard
MVP
i would expect an irule to do that already exists but i can't find anything.
you will probably need to combine some existing irules.
the one you suggest + something like this: https://devcentral.f5.com/articles/preventing-brute-force-password-guessing-attacks-with-apm%E2%80%93part-4 and ignore the APM parts.
you would create a table with all client IPs and a connection counter, do a counter+1 when an IP makes a connection. then when it reaches some limit block it for an hour and clear the counter.
