What is a brute-force attack; how does TR7 protect the management interface and applications against it?

Short answer

A brute-force attack tries to guess a password or another credential by making a large number of attempts (OWASP); besides web logins, services such as SSH, FTP, SMTP and RDP are also targets. TR7 protects the management interface with the Brute-Force Protection settings on the Management Access screen: an IP address that reaches the Max. Failed Login per IP limit, or an IP and username pair that reaches the Max. Failed Login per IP & Username limit, cannot log in for the Failed Login Expire Time duration; a limit set to 0 is not applied. HTTP(s) CAPTCHA Login Protection can also be added to the login screen. In applications protected by AGS, Account Lockout Policies limit the failed attempts with warning, CAPTCHA and account lockout stages. Known sources of attempts are kept in the IP Intelligence & Reputation database in the Brute-Force, FTP Brute-Force and SSH categories; on vServices with Bot/DDoS protection on, IP Reputation Protection puts the Brute-Force category into Quarantine by default.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → Settings → Device Management → Management Access → Edit	Brute-Force Protection: Max. Failed Login per IP, Max. Failed Login per IP & Username, Failed Login Expire Time	Failed login limit and waiting time for the TR7 management interface
Management Access → Edit	HTTP(s) CAPTCHA Login Protection (off by default)	Asking for a CAPTCHA at management interface login
Left Monitor Panel → Route Tables & L4 DDoS → DEFAULT route table → L4 DDoS Management	Management Ports box	Concurrent connection ceiling per source for SSH, HTTP and HTTPS management access (in Block mode by default)
Configuration Menu → AGS → Account Lockout Policies	Lockout Threshold, Enable Captcha Protection	CAPTCHA and account lockout at application logins
Configuration Menu → AGS → Bot Protection Policies	Trigger Type = Auth failures	Triggering a policy by the number of failed authentications
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Categories → Brute-Force, FTP Brute-Force, SSH	Addresses reported for brute-force attempts

Common Misconceptions

• "A strong password provides sufficient protection." If the number of attempts is not limited, the attack keeps wearing down the accounts and the system; the Brute-Force Protection limits and Account Lockout Policies are used together with a strong password.
• "A per-username limit alone is enough." The attacker can try a different username in every attempt; Management Access applies separate limits both per IP and per IP-and-username pair.
• "An address caught by the limit is blocked permanently." The block is lifted when the Failed Login Expire Time duration, counted from the last failed attempt, expires.

How it is done in the documentation

• Management Access · Brute-Force Protection
• Management Access · CAPTCHA
• Account Lockout Policies · Operating Mechanism
• Management Ports · What Is Management Ports?
• IP Intelligence & Reputation · IP Categories

Related questions

• What is a CAPTCHA; in which protections is it used in TR7?
• What is IP Reputation; where does TR7 use IP Reputation data?
• What is rate limiting; at which layers is it applied in TR7?