Brute-Force Protection and Access Restriction

Point any FTP or SFTP service at the internet and watch the logs: within hours, automated guessing begins. Credential attacks are the background radiation of running a transfer endpoint — constant, impersonal, and occasionally successful against weak accounts. Defending against them is a solved problem, but only if you actually assemble the defenses.

This series assembles them in order: what the attacks look like on the wire and in the logs, lockout and throttling that stop guessing without locking out partners, allowlisting where your user population makes it possible, log-driven auto-banning for everything else, design choices that end password guessing entirely, and the monitoring that tells you when someone graduates from noise to targeting.

Articles in This Series

• The Anatomy of Brute-Force and Credential-Stuffing Attacks
  Dictionary attacks, stuffing with breached credentials, and low-and-slow spraying — what each looks like in your logs and why transfer ports attract them.
• Designing Lockouts and Throttling Without Self-DoS
  Thresholds and backoff that punish guessing, not typos — partner-safe policies, unlock paths, and monitoring the lockout events themselves.
• IP Allowlisting and Geo-Restrictions for Transfer Endpoints
  Where allowlists shine (B2B flows with known partners), the maintenance burden, honest geo-blocking expectations, and break-glass access design.
• Log-Driven Auto-Banning for Transfer Services
  The watch-logs-and-ban pattern: rules for transfer-service logs, partner whitelisting, ban durations, and handling the inevitable false positive.
• Ending Password Attacks by Design
  Key-only authentication as the attack-ender, disabling password auth where possible, the honest case for nonstandard ports, and what obscurity does and doesn't buy.
• Watching Credential Attacks in Your Logs
  Baselines for normal failure rates, alert thresholds, separating scanner noise from targeted attention, and when an attack deserves escalation.

Explore More Topics

This series is part of the Sysax file transfer topic library, which covers the protocols, security practices, automation techniques, and operational skills behind reliable file transfer. The library pairs well with the practical tools we build: Sysax Multi Server, a secure FTP, FTPS, SFTP, and HTTPS server for Windows, and Sysax FTP Automation, which schedules and scripts secure transfers so the routine ones run themselves.