ProVide’s Anti-Hammering protects your SFTP, FTP, and FTPS server from brute-force and password-guessing attacks by slowing down and then banning IP addresses that repeatedly fail to log in. You control it with three settings: throttle connections, ban IPs, and an allow list. With the default ban setting, an IP is blocked after 5 failed login attempts within 45 seconds.
Here is what each setting does and how to use it.
Throttling connections #
When you turn on Throttle connections, each failed login forces the next attempt from that same connection to wait a set number of seconds before it can try again. You choose the delay. This slows an attacker to a crawl without locking out a legitimate user who simply mistyped a password.
Banning IPs #
When you turn on Ban IP, ProVide blocks an IP address after too many failed attempts in a short window. The default is 5 failed attempts within 45 seconds, and you can adjust both numbers to match your security policy. Once banned, the IP cannot connect until the ban expires.
Allow list (Always allow connections) #
Enable “Always allow connections to ProVide” to enter IP addresses that are permanently trusted. Addresses on this list can always connect and are never banned, no matter how many failed attempts they trigger. Use this for your own office IPs, monitoring systems, or automation hosts so a script that fumbles a login doesn’t lock itself out.
Putting an expiry date on a rule #
You can attach a date and time to any entry in all three fields. Enter the IP, date, and time together, like this:
10.2.0.73 2020-10-22 14:10Added to the “Always allow connections” field, that entry makes 10.2.0.73 immune to bans until 14:10 on 22 October 2020, then the rule lapses. You can set a different expiry for each IP, which is handy for granting a contractor or temporary host trusted access that cleans itself up automatically.
