Description

An IDP policy is deployed and there is requirement to tune the number of failed logins for detection of a FTP brute-force attack. This article provides an example configuration.


Symptoms

There is requirement to adjust number of failed logins that trigger the detection of a FTP brute-force attack.  
How do you accomplish it? 


Solution

In configuration mode, enter the following command to set the FTP sc_ftp_failed_logins to the preferred tunable-value (range: 2 to 64):

root@srx# set security idp sensor-configuration detector protocol-name FTP tunable-name sc_ftp_failed_logins tunable-value ?
Possible completions:
<tunable-value> Protocol tunable value

Example:
To detect FTP brute-force at the second failed login, enter the command:

root@srx# set security idp sensor-configuration detector protocol-name FTP tunable-name sc_ftp_failed_logins tunable-value 2

Verification:
To see the attack matches, enter the command:

root@srx> show security idp attack table

IDP attack statistics:

Attack name #Hits
FTP:PASSWORD:BRUTE-FORCE 1

For more information, see show security idp attack table .