Re: 100's of logon errors for MSFTPSVC, event id: 100

Another good security measure (in my opinion) if you need to host an FTP site
on your SBS is to create a user and only give that and only that user access
to the FTP site. Ofcourse you want to set a very secure password for that
one user and use that username for all FTP transactions in the company. I
believe there is a good article on thia at www.smallbizserver.net

"Mike Webb" wrote:

Thanks for the comment!

"Mal Osborne" <mal@xxxxxxxxxxxxx> wrote in message
news:E3836946-1653-460E-BA9D-312F483CFC27@xxxxxxxxxxxxxxxx
That is an easy one!

You have FTP exposed to the outside world, hackers have seen it listening
on port 21, and are trying a variety of common passwords to see if they
can fluke it. If the credentials "Administrator" & "password" could
allow FTP access, they would almost certainly have managed by now. If
your admin password is a strong one, they probably will not. If you have
a user who uses a weak password, hackers may manage to guess it.

If your server is full of child porn, phishing sites, stolen credit card
numbers & pirate software, then they have guessed right!

Hackers can also derive a username from an email address, ie, if they have
the name fred@xxxxxxxxxxxxxxx, they can try authenticating against FTP or
SMTP (to relay). They use the username "fred", and DNS lookup
"somecompany.com" Of course if all of your users have strong passwords the
will fail.

All ot this hacking activity is done via automated scripts, usually from a
machine that hackers have already compromised. Its easy for a script to
scan thousands of IP addresses for an FTP server, and try thousands of
passwords.

Any site that has FTP enabled *WILL* be hit with password guesses, strong
passwords will trump the attacks.

Only real defense if to ensure strong passwords are in use. Getting rid
of FTP if it's not needed is reasonable idea as well, but strong password
are really essential. Its easier to have strong passwords than try to
figure out & block everywhere that hackers may try to authenticate.

Mal Osborne
MCSE Mensa


"Mike Webb" <Mike_Webb@xxxxxxxxxxxxxxxxx> wrote in message
news:%23CDtAuohHHA.5048@xxxxxxxxxxxxxxxxxxxxxxx
Running SBS 2003 Premium, ISA 2004, SQL, WSUS, 2 NIC's and a router,
Symantec Backup Exec 11d, dynamic IP, DDNS service through dyndns.org.
============================
Checking the weekly Server Report I saw this. Checked the System Log and
saw this over and over again. Seems to be running every 2 seconds and
goes back to at least 11 April (end of my log). What do I check? Am I
being hacked?

--
Mike Webb
Platte River Whooping Crane Maintenance Trust, Inc.
a 501 (c)(3) conservation non-profit organization





.

Relevant Pages

  • Re: FTP External Intranet Access
    ... gain CMD access to the server and change things around on the OS ... I like Susan's idea of a third party, non AD integrated FTP service. ... LOphtCrack to brute force the passwords. ... SBS Golfer wrote: ...
    (microsoft.public.windows.server.sbs)
  • Re: 100s of logon errors for MSFTPSVC, event id: 100
    ... You have FTP exposed to the outside world, hackers have seen it listening ... If your server is full of child porn, phishing sites, stolen credit card ... "somecompany.com" Of course if all of your users have strong passwords the ...
    (microsoft.public.windows.server.sbs)
  • Re: can ping, but cant ftp
    ... > A SETPARMS.arpa.sys file has never been included in a FTP ... > implementation of security/3000 passwords (instead of MPE ... >> I have customers from all over the world logging to my ...
    (comp.sys.hp.mpe)
  • Re: 100s of logon errors for MSFTPSVC, event id: 100
    ... You have FTP exposed to the outside world, hackers have seen it listening on port 21, and are trying a variety of common passwords to see if they can fluke it. ... Its easy for a script to scan thousands of IP addresses for an FTP server, ...
    (microsoft.public.windows.server.sbs)
  • Re: 100s of logon errors for MSFTPSVC, event id: 100
    ... Giving only that user access by way of a username will still create hacking attempts. ... To secure it down, if users have fixed IPs you can configure FTP to deny all, except relevant IPs ... > a user who uses a weak password, hackers may manage to guess it. ... > "somecompany.com" Of course if all of your users have strong passwords> the ...
    (microsoft.public.windows.server.sbs)