Todd Miller (O&G Company) asked a question.
IP Lockout Notifications
Hello, I searched AI for a solution for this but its not clear if it will work. I basically want to get notified if a certain IP gets locked out on our MOVEit Transfer server. From my research, enabling Email Notifications: ON+Admin was the only solution. So this will give me ALL IP lockouts + other administrative stuff. Is this really the only solution?
I believe so. If you don't need to know about the lockout urgently, I'd suggest creating a custom report instead. If it's an important IP that you don't want to get locked, whitelist it as a trusted host.
Hello and Thanks. Its a load balancer so when it gets locked, its locking out external users but still allows internal users or users with perm accounts. When its locked and users send packages, the end users get a username and PW but it doesnt work because the IP is randomly getting locked out. Once we unlock the IP, access is restored. We know about the F5 insert of the client ip into the headers of the HTTP request using X-FORWARDED-FOR (xff) attributes but since it requires fully trusting the IP this poses a problem with security. So now we are looking at monitoring IP lockouts.
Been there...set the LB as a trusted host, also MOVEit automation and any network devices that multiple connections could come from
https://community.progress.com/s/article/How-do-I-whitelist-an-IP-Address-in-MOVEit-Transfer-DMZ
If the LB is a trusted source, it presents a brute force risk since all IPs are routing through the same IP and its a trusted source, no?
You should be handling brute force/DOS attacks on your WAF/Firewall. But if your LB is trusted and in MIT you are seeing the originating IP address from host header inserts, you can still block that. MIT will treat it as the original when it checks to see if a login is allowed.
Thanks for the comment. I will again try to get security and network onboard with this!