Block access based on usernames

Introduction
The Problem: Username-Based Attacks Create Hidden Costs
The Solution: Blocking Known or "High-Risk" Usernames Early
Conclusion
Get help from experts

Introduction

Authentication services, like Active Directory or LDAP servers, are critical to maintaining secure access to your FTP, SFTP or HTTPS server or the administrative services. However, these services can also become points of strain, especially under constant attack by automated bots and malicious actors. One surprisingly effective strategy for reducing unnecessary authentication load, and therefore operational costs, is blocking access attempts based on known usernames.

In this article, we'll explore why addressing username-based attacks is important, how preemptively blocking requests for certain usernames can dramatically reduce authentication load on your FTP server, and best practices for implementing this technique with SFTPPlus MFT.

The Problem: Username-Based Attacks Create Hidden Costs

Many authentication services, whether for intranet systems or public-facing applications, are under constant attack.

Attackers often use automated tools to enumerate usernames by attempting logins against common or guessed FTP / SFTP usernames. They will use brute force to try various passwords on common usernames like admin, test, user, or application-specific defaults. This can trigger unnecessarily MFA requests for your FTPS or SFTP servers, increasing the operating costs of your infrastructure.

Each FTPS / SFTP server login attempt, even a failed one, typically results in backend processing: database lookups, API calls to identity providers, and security event logging.

This can:

Increase CPU and memory load on your server.
Inflate log storage and monitoring costs.
Push services closer to expensive auto-scaling thresholds.
Lead to higher costs for external MFA/identity APIs, many of which charge per transaction.

In large-scale environments or during sustained attack periods, the cumulative cost becomes non-trivial.

In cloud-native environments where authentication cost is tied directly to resource usage (e.g., API Gateway, serverless identity management), these savings can be even more pronounced.

The Solution: Blocking Known or "High-Risk" Usernames Early

By blocking authentication attempts against a set of "known" usernames, before they trigger full authentication workflows, systems can reject unauthenticated requests with minimal processing.

SFTPPlus MFT is based on a modular authentication architecture which allows inserting the username based blocking process at the start of the authentication chain. In this way the authentication requests are protected on your FTPS or SFTP server.

In this article we provide a high level introduction to the authentication process. You can check the SFTPPlus MFT deployment details as part of our documentation pages.

Instead of forwarding the authentication requests through the normal (and expensive) authentication pipeline, the system can immediately return an error. When rejecting blocked usernames, SFTPPlus MFT uses uniform error messages ("Invalid login" rather than "User not found") to avoid helping attackers confirm which usernames are valid.

With extensive audit and log tools available with SFTPPlus MFT, you can track the number of blocked requests over time. A sudden spike in blocked usernames may indicate new attack campaigns, helping security teams respond faster.

With SFTPPlus MFT you can define username based blocking list for file transfer services that are separate from the blocking list defined for the administrative services.

Besides blocking based on usernames, SFTPPlus MFT provides a dynamic block list for source IP addresses, based on the observed pattern of previous failed authentication attempts.

Best Practices for Username-Based Blocking

Update the list based on current attack patterns observed in logs
Place the username check as early as possible in the authentication pipeline.
Track the number of blocked requests over time.
Combine with time-based source IP blocking methods to mitigate the effectiveness of brute force attacks.

You can check the SFTPPlus MFT documentation page dedicated to blocking source IP addresses to see how to combine various authentication methods.

Conclusion

With SFTPPlus MFT, blocking authentication attempts for known usernames is a low-effort, high-reward technique for improving the resilience and cost-efficiency of authentication services. By rejecting high-risk or non-existent usernames early, organizations can free up valuable resources, protect their systems from abuse, and keep operational costs under control.

These prevention measures are available in SFTPPlus MFT for any file transfer server, including the FTP, SFTP or HTTPS servers.

As attacks grow more frequent and authentication systems scale to meet increasing demands, intelligent defenses like username-based blocking will become even more essential to maintaining secure and cost-effective services.

Get help from experts

If you're looking to strengthen your authentication process and reduce unnecessary load on your systems, our team is here to help. We can guide you in implementing effective username-based blocking strategies and other security enhancements tailored to your environment.