ts_block

Blocks IP addresses generating invalid Terminal Services logons (by EvanAnderson)

Ts_block Alternatives

Similar projects and alternatives to ts_block

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better ts_block alternative or higher similarity.

ts_block reviews and mentions

Posts with mentions or reviews of ts_block. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2023-10-06.
  • Learning Lessons From The Cyber-Attack: British Library cyber incident review [pdf]
    1 project | news.ycombinator.com | 8 Mar 2024
    > Is there something inherently insecure about remote desktops, or is MS software here known to be particularly insecure...

    Exposing RDP to the Internet directly has been frowned-upon because of the attack surface being presented, there's no two factor "story" out-of-the-box, and you're opened up to brute force attempts on cruddy user passwords.

    Older versions of the Microsoft Remote Desktop Protocol had a much larger attack surface than current versions. The current versions with Network Level Authentication (starting in Windows Vista/Server 2008) present a smaller attacks surface. Older versions used "homegrown" Microsoft crypto, whereas current versions use TLS.

    Disclosure: I made a FLOSS fail2ban-like tool for RDP many years ago[0]. I had a situation where I was forced to expose RDP to the Internet and I didn't like having it open w/o some protection against brute force attacks. This tool happens to still works in Server 2022 and will slow the velocity of brute force attacks. I still highly recommend not exposing RDP directly to the Internet anyway.

    (The ts_block tool is missing some fairly essential functionality that I never got around to implementing. It works fine and is really easy to install but some things are sub-optimal.)

    [0] https://github.com/EvanAnderson/ts_block

  • Fail2Ban – Daemon to ban hosts that cause multiple authentication errors
    5 projects | news.ycombinator.com | 6 Oct 2023
  • Analysis of a large brute force attack campaign against Windows Remote Desktop
    4 projects | news.ycombinator.com | 5 Jun 2022
    My old ts_block[0] project does something similar to yours, albeit for RDP only and with much less sophisticated customization.

    I opted to go with a WMI Event Sink rather than polling the Event Log. I've never done a benchmark to see which architecture would use less CPU, but I can say the WMI event sink causes nearly instantaneous reaction.

    As an aside: I'd love to hear if somebody tries ts_block on Windows Server 2022. It works fine on 2012 R2 thru 2019 but I've never tried it on 2022.

    [0] https://github.com/EvanAnderson/ts_block

  • WinGet is terrible. I want AppGet back
    19 projects | news.ycombinator.com | 17 Apr 2021
    The perspectives in the comments on this article re: WiX XML source and Windows Installer being difficult are interesting to me. Like I said elsewhere, I overcame that learning curve so long ago that I can't put myself in a position where it seems daunting now.

    To be fair, though, an MSI to install a 10 files in "C:\Program Files\AppName", register a couple .NET assemblies, create a couple of shortcuts, and throw a few values into the registry would amount to <100 lines of XML.

    Here's a years-old WiX 2.0 syntax source file to install 4 files in "C:\Program Files\appname" and run an EXE embedded in the MSI to install a service: https://github.com/EvanAnderson/ts_block/blob/master/MSI/ts_...

    I've only seen "thousands of lines" of WiX source when dealing programs that install a ton of files, or put scads of entries in the registry.

    Most of the MSIs with WiX are based on a simple skeleton generated from a template, and using "includes" generated by the "candle" tool.

    Understanding the Windows Installer and the WiX source feels analogous to what I see in "modern" web development-- a bunch of tools that developers use, seemingly without understanding what they do, to create a massive pile of edifice into which original code is finally placed.

  • A note from our sponsor - InfluxDB
    www.influxdata.com | 24 Apr 2024
    Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality. Learn more →

Stats

Basic ts_block repo stats
4
175
0.0
over 2 years ago

EvanAnderson/ts_block is an open source project licensed under Artistic License 2.0 which is an OSI approved license.

The primary programming language of ts_block is Visual Basic.


Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com