Server Does Not Enforce Login Attempt Limit with SSL

[jguire1]

I have autoban enabled for 5 failed login attempts. I also "Force SSL for user login". The autoban never fires because, I assume, users attempting login get the return error stating that SSL is required and the attempt is not counted into the autoban limit. This situation results in daily logs of up to 3MB in size due to repeated brute force attempts at login. It appears as if there is a program that kiddie hax0rs all over the world have available. I add address masks to the IP Filter as attempts are made, but new kiddies keep trying. I've filtered out most of China by now. Please see the attached log exerpt.

[jguire1]

Excerpt from server log

[Tim Kosse]

Autoban will be removed in a future version of the server. That feature has been slapped on as a band-aid to pacify lots of clueless whiners, it does not serve any purpose. A long password is all you need to keep the server secure.

[jguire1]

Yes, a long password is all that is needed to keep the server secure. Security is not the issue. By not having an autoban to handle this situation, the server sometimes gets banged with up to 6 login attempts per second for as long as 7 hours. Once a ban is placed, as I have been manually doing when I notice the activity, the attempts stop. The autoban is needed to halt partially effective DOS, not for security. If this were a one-time event, you would not have even heard from me. But this happens almost daily. If there is an alternative way of handling this situation automatically, please let me know. (I'm trying not to whine) :)

[jguire1]

Yes, a long password is all that is needed to keep the server secure. Security is not the issue. By not having an autoban to handle this situation, the server sometimes gets banged with up to 6 login attempts per second for as long as 7 hours. Once a ban is placed, as I have been manually doing when I notice the activity, the attempts stop. The autoban is needed to halt partially effective DOS, not for security. If this were a one-time event, you would not have even heard from me. But this happens almost daily. If there is an alternative way of handling this situation automatically, please let me know. (I'm trying not to whine) :)

[Kurt McKee]

Triage suggestion

FileZilla Server 0.9.60 still has an autoban feature. I have not attempted to confirm if "upgrade to SSL" attempts are still not counted toward the autoban limit. However, this ticket has not had any movement in nine years.

I suggest closing this ticket.