Re: FTP Login anomaly

From: Bernard (qbernard_at_hotmail.com.discuss)
Date: 03/18/05 

Date: Fri, 18 Mar 2005 11:43:38 +0800

Can you post the log here ? 

-- 
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/
"Ben" <b_gardy*REMOVE*@hotmail.com> wrote in message 
news:ekSrJO0KFHA.576@TK2MSFTNGP15.phx.gbl...
>I am running IIS5.0 with windows user accounts for FTP login. I had a 
>problem with a user complaining about not being able to connect. I checked 
>the users account and it was locked out. I looked at the logs and noticed 
>numerous attempts to login. I tried myself with a different account 
>entering a wrong password and the logs showed 3 attempts, not 1. Is this 
>normal? I set the Local Security to 5 invalid attempts but if one incorrect 
>login counts 3, I would have to triple the Invalid Attempts to allow 5 
>incorrect passwords, no?
>
> Thanks,
>
> Ben
>

Relevant Pages

  • Re: FTP Login anomaly
    ... Sorry for the delay posting the logs. ... Busy busy busy. ... >>I am running IIS5.0 with windows user accounts for FTP login. ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: Windows event auditing and reporting
    ... Microsoft Windows NT based products all can use System Monitor, it's built in and provides a facility to set up trace logs ... Windows Event logs, especially DC logs for events such as New user accounts, changed user accounts, deleted user accounts, locked user accounts, failed login attempts, expired passwords, dormant accounts, etc. ... The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. ...
    (Security-Basics)
  • Re: Auto Populating Blocked IPs List
    ... I just checked my security logs - which I save - and I see ... The earlies attacks were trying to almost invariably login as ... >IP blocks their ISP is handing out and allow only those. ... Bill Vermillion - bv @ wjv. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Last Login
    ... The table "tblLastLogin" gets updated when ... intCount gets successfully populated with the number of stories since last ... login but intLastLogin does not get updated, ... If it gets updated as soon as the publisher logs in, ...
    (microsoft.public.access.queries)
  • Re: sshd authentication failure message
    ... >> happen with every login, at least remote, although the user logs in ... > the rpm. ... > I think it is a function of how many people actually look at the logs ... > If there is a fix as well as stopping the login delay on a successful ...
    (RedHat)