FileMaker Server logs failed logins faithfully and does nothing about them. FM Guardian watches all five ways in to a Mac server, correlates them into one picture per address, and blocks the persistent ones at the firewall — automatically, overnight, without you.
Built and run by Coates IT on our own managed Mac servers. Ubuntu servers are covered by Fail2Ban; this is the Mac counterpart.
There is no setting you have missed. FileMaker Server will accept an unlimited number of wrong passwords from the same address, all night, and record every one of them in a log that nothing reads. Lock-out after N failures — ordinary in almost every other server product — simply is not there.
Nobody has touched your server. Nobody has checked whether anybody has.
A Mac running FileMaker Server exposes more than port 5003. FM Guardian reads all of it, and an address rattling several doors at once escalates faster than one only rattling a single door.
| Surface | How it is detected | Available |
|---|---|---|
| FMS native :5003 | Event.log — failed logins from FileMaker Pro and Go |
Every install. Clients connect directly, so the address is the real one |
| Admin Console | Event.log — failed administrator sign-ins |
Every install |
| SSH :22 | Unified log or auth.log |
Every install. Constant background brute-forcing on any internet-facing Mac |
| WebDirect :443 | Event.log, plus the web server access log for the login screen |
Every install. Database-level failures, plus the initial login screen, which FileMaker Server does not log itself |
| Data API :443 | Web server access log — 401s against /fmi/data/ |
Every install. The quietest and most scriptable route in |
Where a reverse proxy fronts FileMaker Server, its own web server may never start — and
then it writes no access log, so the WebDirect login screen and Data API surfaces go
quiet. Guardian tells you which sources are live rather than showing a hopeful green
tick. FMS native, Admin Console and SSH read from Event.log and the system
log, so they are unaffected either way.
If Caddy, nginx or Cloudflare sits in front of FileMaker Server, its logs record the proxy's address on every request rather than the visitor's. Guardian will never block a private or proxy address — banning one stops no attacker and can take a site off the air. Port 5003 and SSH arrive directly and are unaffected.
This is the part most tools get wrong, quietly, and it is worth being explicit about because you can check our working.
Because the firewall in System Settings is an application firewall. It decides which programs may accept incoming connections — it has no concept of who is connecting. You can confirm that in one command: every option it takes is the path of an app, and not one of them takes an address.
If FileMaker Server is meant to be reachable, that firewall lets it be reached — by everybody, including whoever is working through your passwords. The only thing on a Mac that can block a single address is pf, the packet filter underneath, which macOS ships switched off and gives you no interface for. Setting pf up correctly, and proving it is actually enforcing, is most of what FM Guardian does.
A pf table is a named list. On its own it filters nothing — and macOS ships with pf switched off, so even a correct rule sits idle until something enables it. A tool doing only this looks like it is working, and blocks nobody.
A pf anchor holding both halves, two lines in pf.conf to load it, and a
boot daemon so it survives a restart. The app reports “enforcing” only when pf is
genuinely on and the rule is genuinely loaded — never merely because a
command succeeded.
A single macOS admin password prompt installs all four pieces. After that FM Guardian runs unattended. No terminal, no ongoing password prompts.
Guardian is granted one small root-owned helper with a fixed set of operations —
not unrestricted pfctl, which would let anything running as that user
rewrite or disable your firewall.
One button removes the anchor, the helper, the sudoers entry and the boot daemon,
and restores pf.conf. Nothing is left behind on a server you stop using
it on.
The full technical breakdown — every file it touches, and how to verify it yourself →
When a CDN or reverse proxy fronts your server, its web log records the proxy's address on every request — not the visitor's. We found this on our own server: sixty-one failed WebDirect logins, every one attributed to a single Cloudflare edge node.
Ten failed logins from what looks like one address, and it blocks that address. Except the address is Cloudflare, carrying everyone's traffic. WebDirect goes down for every legitimate visitor routed through that edge, and the attacker — whose real address was never in the log — carries on.
Known proxy ranges are never blocked — not by an automatic ban, not by hand, not by accident. And FileMaker numbers each login attempt in the URL itself, so Guardian reads that instead: it counts the session, which a proxy cannot obscure.
On a proxied server that alert is the only WebDirect signal there is — and Guardian says so plainly, pointing you at rate limiting on the CDN rather than pretending it has the attack covered. A tool that quietly blocks nothing, or worse blocks your own customers, is the failure this product exists to avoid.
We pointed FM Guardian at a live server with four and a half months of history: 3,553 failed logins, and not one of them an attacker. Every single address near a blocking threshold was a named member of staff with a saved password that had stopped working — including the owner's own laptop.
FileMaker Server records who each connection is, and most tools throw that away and count addresses. Ten failures becomes a block, and the block lands on the person whose stored credential went stale — usually first thing on a Monday, usually the busiest user.
Guardian keeps the client name FileMaker recorded and shows it beside the address — under Watching, on any block, and in the licence warning that lists exactly who would be blocked before you switch enforcement on. The name never affects the decision, because a client supplies it and an attacker could put anything there. It informs you; it does not authorise anybody.
The People screen lists every client that has failed a login in the last 90 days — no thresholds, no alarms — with one column that changes everything: whether that client has ever connected successfully.
Hundreds of failures with a healthy session count is somebody mistyping a password. Hundreds with never is a scheduled script or a machine holding an account that was changed months ago, failing every fifteen minutes since, with nobody watching. On the server above there were two of those — 534 failures and 128 failures, neither of which had ever once authenticated.
This is the part nobody advertises, because it is not the exciting half. But a security tool that blocks your own staff gets uninstalled in a week, and one that quietly surfaces the broken automation nobody knew about earns its place on the server.
Our Ubuntu FileMaker servers use Fail2Ban and always have. FM Guardian exists because that tooling has no good macOS equivalent, and plenty of FileMaker Servers run on Mac minis and Mac Studios.
Claris shipped five FileMaker Server updates in the past year, each with security fixes. Blocking brute-force attempts does not close a vulnerability in the software being attacked. Both matter.
FM Guardian reads failures. Someone logging in with credentials they should not have looks like a successful login, and that is a different problem — one that access-log review, not automated blocking, is for.
Localhost and the server's own outbound address are whitelisted from the start, and whitelisting an address lifts any existing block before it saves. Locking yourself out of your own server is the obvious failure mode and it is designed against.
The default is a one-hour block, because most of this is automated and moves on. A persistent address that comes back simply gets blocked again. You can change both the threshold and the duration.
If pf is off, or the rule is not loaded, the app says so plainly rather than showing a green tick. A security tool that quietly stops working is worse than no security tool.
Cancel any time — protection continues to the end of the period you have paid for. A licence covers two servers, so a rebuild or migration does not need a support call.
Your licence key is emailed the moment payment completes. Prices exclude VAT, which is calculated at checkout. Already with us on a hardening package? FM Guardian is part of what that already covers — email us for your key.
The app runs unlicensed as a monitor: it watches all five surfaces and shows you exactly what is hitting your server. Add a licence when you want it to start blocking. That way you can see the traffic before you spend anything.
Universal — Apple Silicon and Intel. Signed and notarised by Apple, so it opens with a normal double-click.
