Skip to content

Defender

The built-in defender allows you to configure an auto-blocking policy for SFTPGo and thus helps to prevent DoS (Denial of Service) and brute force password guessing.

If enabled it will protect SFTP, HTTP, FTP and WebDAV services and it will automatically block hosts (IP addresses) that continually fail to log in or attempt to connect.

On the HTTP and WebDAV services the defender, the rate limiters and the per-host connection limit check each request once its TLS handshake has completed, and on implicit FTPS the reply to a refused connection completes the handshake first: to refuse a source before any TLS handshake, filter it in front of SFTPGo, for example at a firewall or a load balancer.

You can configure a score for the following events:

  • score_valid, defines the score for valid login attempts, eg. user accounts that exist. Default 1.
  • score_invalid, defines the score for invalid login attempts, eg. non-existent user accounts. Default 2.
  • score_no_auth, defines the score for SSH and FTP connections closed before a login attempt. Default 0.
  • score_limit_exceeded, defines the score for hosts that exceeded the configured rate limits or the configured max connections per host. Default 3.

You can set the score to 0 to not penalize some events.

And then you can configure:

  • observation_time, defines the time window, in minutes, for tracking client errors.
  • threshold, defines the score at which a host is banned.
  • ban_time, defines the time to ban a client, as minutes

So a host is banned, for ban_time minutes, when the sum of its scores during the last observation_time minutes reaches the defined threshold.

By defining the scores, each type of event can be weighted. Let's see an example: if score_invalid is 3 and threshold is 8, a host will be banned after 3 login attempts with an non-existent user within the configured observation_time.

A banned IP has no score, it makes no sense to accumulate host events in memory for an already banned IP address.

Each connection from a banned host, and each request on the HTTP and WebDAV services, extends its ban by ban_time_increment, a percentage of ban_time: if ban_time is 30 minutes and ban_time_increment is 50, every new attempt adds 15 minutes. The extension is at least one minute, so a host that keeps connecting stays banned. ban_time_increment accepts values from 1; values above 100 extend the ban by more than ban_time at each attempt.

SFTPGo can store host scores and banned hosts in memory or within the configured data provider according to the driver set in the defender configuration section. The available drivers are memory and provider. The provider driver is useful if you want to share the defender data across multiple SFTPGo instances and it requires a shared or distributed data provider: MySQL, PostgreSQL and CockroachDB are supported. If you set the provider driver, the defender implementation may do many database queries (at least one query every time a new client connects to check if it is banned), if you have a single SFTPGo instance the memory driver is recommended.

For the memory driver, you can limit the memory usage using the entries_soft_limit and entries_hard_limit configuration keys.

The provider driver will periodically clean up expired hosts and events.

Using the WebAdmin UI or REST API you can:

  • list hosts within the defender's lists
  • remove hosts from the defender's lists

The defender can also check permanent block and safe lists of IP addresses/networks. You can define these lists using the WebAdmin UI or the REST API. In multi-nodes setups, the list entries propagation between nodes may take some minutes.

The defender also allow to delay reporting failed authentications as a way to slow down password guessing attempts.