samba - Jun 2016 - lockout ip address after bad logon attempts

Greetings!

Is there any way to to lockout a certain machine identified by its ip
address after a fix number of bad logon attempts?

I'm aware of account policy option "bad lockout attempts" but that
would
block the whole account and not just the machine.

Have a sunny day!

Ferdinand

Yes, we would also very much like to see such an option.

As far as I know this cannot be done now. Unfortunately IPs are not logged:
> Thu Jun 23 10:09:28 CEST 2016 auth_check_password_recv: sam_ignoredomain
authentication for user [OURDOMAIN\username] FAILED with error
NT_STATUS_WRONG_PASSWORD
and nothing more... :-(

MJ

On 06/23/2016 11:44 AM, "Maximilian Ferdinand Müller"
wrote:
> Greetings!
>
> Is there any way to to lockout a certain machine identified by its ip
> address after a fix number of bad logon attempts?
>
> I'm aware of account policy option "bad lockout attempts" but
that would
> block the whole account and not just the machine.
>
> Have a sunny day!
>
> Ferdinand
>
>

On 6/23/2016 5:44 AM, "Maximilian Ferdinand Müller"
wrote:
> Greetings!
>
> Is there any way to to lockout a certain machine identified by its ip
> address after a fix number of bad logon attempts?
>
> I'm aware of account policy option "bad lockout attempts" but
that would
> block the whole account and not just the machine.
>
> Have a sunny day!
>
> Ferdinand
>
>
Is this a remote machine or local machine you would like to block?

-- 
-James