Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Maximum size/length of BannedIpList #1257

Closed
CJA-Emory opened this issue Jul 30, 2018 — with docs.microsoft.com · 24 comments
Closed

Maximum size/length of BannedIpList #1257

CJA-Emory opened this issue Jul 30, 2018 — with docs.microsoft.com · 24 comments
Assignees
@billmath @IngridAtMicrosoft
Labels
assigned-to-author identity Applies to identity content Pri2 triaged windows-server-threshold/prod

Comments

@CJA-Emory docs.microsoft.com
Copy link

What's the maximum size/length of the BannedIpList?

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
@dawnwood dawnwood added identity Applies to identity content triaged assigned-to-author labels Jul 30, 2018
@Nick42- docs.microsoft.com
Copy link

Nick42- commented Sep 19, 2018

300 entries, at least per the command itself (I had a list MUCH longer....). This REALLY needs to be longer. Like 5 digits longer.

@hodgesb docs.microsoft.com
Copy link

hodgesb commented Oct 8, 2018

I agree, we need much more than 300 entries.

@leohoknows docs.microsoft.com
Copy link

Nick42 were you using a script to read from a file containing your 300+ banned IP list?

@Nick42-
Copy link

Nick42- commented Oct 22, 2018 via email

@Nick42-
Copy link

Nick42- commented Oct 22, 2018 via email

@leohoknows
Copy link

FYI, this is how I went through automating adding banned IPs to ADFS.

We have a list of banned IP addresses that gets updated from our PaloAlto to a CSV file.

I created the following powershell script to pull the IPs from the CSV and then add those IPs to the ADFS bannedip list:
$BNPBannedIPs = Get-Content C:\Scripts\ADFS\Test.csv
Set-AdfsProperties -AddBannedIps $BNPBannedIPs

Since the CSV file that contains the banned IPs gets updated daily from our PaloAlto,
I created a scheduled task to have the powershell script run daily.

Hope this helps

@Nick42-
Copy link

Nick42- commented Oct 23, 2018 via email

@leohoknows
Copy link

I will let you know if and once I get there :)

@hodgesb
Copy link

hodgesb commented Oct 25, 2018

I hit the 300 limit fairly quickly. I created a powershell script to automatically ban IPs found in brute force password spray attacks in ADFS and I reached the 300 limit. It simply will not increment higher than 300.

@leohoknows
Copy link

Since I'm still fairly new with this, when I run get-adfsproperties I see 4 banned ips followed with an ellipses. Does anyone know how to view all of the banned ips that have been set?

@hodgesb
Copy link

hodgesb commented Oct 25, 2018 via email

@leohoknows
Copy link

Hey Bob, do you happen to know how to remove an ip from a user's list of familiarips?

@Mike-Crowley
Copy link

Mike-Crowley commented Jan 28, 2019 •
edited

Please vote on this topic here:

https://windowsserver.uservoice.com/forums/295047-general-feedback/suggestions/36651025-significantly-increase-the-number-of-banned-ips-th

I can't imagine any organization that is small enough to think 300 is adequate while also being large enough to deploy ADFS in the first place.

EDIT: If you are attempting to block IPs for use with Office 365 federation, you can do this directly in the tenant via Set-OrganizationConfig -IPListBlocked. In my testing, I was able to add ~1173 entries. Listed IP addresses will not be proxied to AD FS for authentication.
ref: https://www.slideshare.net/AndresCanello/azure-ad-password-attacks-logging-and-protections

@KurtBoswood
Copy link

Arrgh... just came across the same issue.
I was in the process of implementing a rotating block list (of known recent brute force attacks), and reached the 300 limit sigh

To assume there are only 300 “bad” IP’s out there in the big wide world is delusional.
I totally agree, and hope the limit is increased! :)

Cheers, Kurt.

@hodgesb
Copy link

hodgesb commented Apr 10, 2019 via email

@reevesjeremy
Copy link

reevesjeremy commented Jun 18, 2019 •
edited

The field accepts CIDR notated ranges. So try getting more spread by blocking large blocks of IPs that are your largest offenders.

You can use tools below to identify appropriate CIDR notation and what IP spaces are owned by who to help identify appropriately what you want to block.

https://www.ipaddressguide.com/cidr and
https://wq.apnic.net/static/search.html

@Nick42-
Copy link

Nick42- commented Jul 12, 2019 via email

@reevesjeremy
Copy link

Still need more entries than the system allows for, since the address spaces are not congruent.

@Nick42- I use Splunk to create a report with all Class B subnets generating excessive EventCode=516, filtered by foreign IPs using Geo location. Sorting by highest count, I check the Class b subnet to ensure the entire net is "owned/operated" by the same foreign entity. Assuming I know that our org does not have affiliates regularly in that geographical location (or require them to VPN if they are), I'll block that entire Subnet range using CIDR. We have 164 ranges covering about 1200 Class Bs. I havn't done a count, but I venture to say that we're blocking millions of IP hosts this way. This reduced our EventsCode=516 from a daily range of 37,000 to 70,000, down to an average of 4,000. Coincidently, most of them are internal now, due to password changes!

If your people are geographically located in places you know, it could be beneficial to block all the other offending geo locations.

Hopefully that helps. If not, sorry! Maybe it could improve but not completely eliminate... I review the splunk alert periodically and tweak a little here and there.

eross-msft added a commit that referenced this issue Sep 25, 2020
@eross-msft
Merge pull request #1257 from eross-msft/update-commands-2
310a22c 
Updating formatting and content
@steved0x steved0x reopened this Oct 28, 2020
@IngridAtMicrosoft IngridAtMicrosoft mentioned this issue Oct 15, 2021
Closed
@IngridAtMicrosoft
Copy link
Collaborator

#please-close

@Nick42-
Copy link

Nick42- commented Oct 16, 2021 •
edited

Curious as to why this is closed?!?!?! I'd venture to say that it's not stale, it's just that everyone is waiting for MS to fix it.

@IngridAtMicrosoft
Copy link
Collaborator

#assign:IngridAtMicrosoft
gh issue comment 1254 -b #assign:IngridAtMicrosoft

@IngridAtMicrosoft
Copy link
Collaborator

#assign:IngridAtMicrosoft

1 similar comment
@IngridAtMicrosoft
Copy link
Collaborator

#assign:IngridAtMicrosoft

@Mike-Crowley
Copy link

Mike-Crowley commented Oct 17, 2023 •
edited

Old convo, but for my own tracking, if nothing else, you can add your own IP list with a plugin like IPBlockPlugin, demonstrated here:

The source code however evaluates single IP addresses:

https://github.com/microsoft/adfs-sample-RiskAssessmentModel-RiskyIPBlock/blob/master/UserRiskAnalyzer.cs#L117

So, if you wanted to use this for ranges or CIDR, you'd have to add that to the UserRiskAnalyzer.cs code.

@Mike-Crowley Mike-Crowley mentioned this issue Oct 17, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@billmath billmath

@IngridAtMicrosoft IngridAtMicrosoft

Labels
assigned-to-author identity Applies to identity content Pri2 triaged windows-server-threshold/prod
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests