Windows Forum

Ask something
Discussion Locked

Blocking Remote Logins

0 helpful
7 replies

by mark

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
This seems simple, but maybe I'm making it hard. I have a web server with public access, but I don't want remote users trying to login. Is there a way to block this without blocking web services, ftp access, etc.? I have trouble with hackers that continuously lockout all my users. They apparently have gotten my SAM and is trying to hack the passwords. I keep having to unlock accounts, but he just comes back and locks them out again. I can see his domain name (Felix) in the security logs, but there is no other info like IP or MAC address. Is there a cheap monitor program that will give me that info? If I deny access to PCs off my LAN, will that block access to my web and ftp services? He even tries the system built-in accounts. It's getting very annoying. How do I block logins from remote sites except for ftp?

7 replies

by charles_j_smith

Mark,

I'll try and give you quick advice. If they have your SAM that can be real bad news!

Aside from that, you should be able correlate the login failure log to you http server's access logs. I will assume you are using IIS so those should be in your windowsdir\system32\logs directory. In your IIS configuration you can see where those logs are. Either way, find those logs and make the correlation based on time (( I am assuming these machines are one in the same and that there is no discrepancy in time)). Then, get with your network team and have them block that subnet at a gateway router or firewall. Quite possibly the entire subnet.

Then, I might even go so far as to suggest contact local authorities or the isp that this user is coming from - since they are quite obviously hacking your systems!

I could sit here and write a lot more. I suggest checking out the SANS reading room for more education on system setup and security on your local network (www.sans.org/rr)

Good Luck,
Chuck

by mark

They apparently have my SAM fromt the older NT4 Server cause they are using correct usernames, but they apparently haven't been successful at cracking the passwords. I Loaded BlackICE on one of the servers as trialware and I think it is going to do what I need. It blocks SMB protocol and I can add my local server IPs to allow them access. I have it mostly open while I try and figure out how to configure it to run only what I want. It at least is allowing me to block remote logins or at least seems to be. We will see in time.

by curacao_dejavu

1: install the url security tool.
http://www.microsoft.com/windows2000/downloads/recommended/urlscan/

2. depends if the server is a standalone server or in a domain, go to the local security policy or the domain security policy and limit the acess the computer via the network (user rights mangement) (since you are there the allow logon locally also)
Nake it so that only your groups have access to the server if nessary.

If they got the sam databe change ALL passwords make use the option password must meet complexity requirements.

better yet, backup the data of the webserver and make a complete install if it's a standalone server.

You can also use the microsoft base analyzer.
http://tinyurl.com/owgw

A complete solution would be to invest in a firewall, sofwarewise I would recommend MS ISA server , for the hardware sonic wall (of course there are others brands out there), So your servers would be complete behind a firewall and more secure.
Still you need to keep updated with the patches, and take care that they don't try to login via the webpage (with the url security tool)

Take a look at this too (a bit more complex, but addes security)
http://tinyurl.com/owh2

Leopold

For general information go to:
http://tinyurl.com/51yk

by mark

I wasn't able to download the lockdown tool as the link on the page said it wasn't available. I have used the older tool before on NT4, but this newer version looks like it might do what I was wanting. Will have to see when I can get it. Right now, I think BlackICE is the answer. The ISA Server looks a bit pricy. I am curious about your comment of login via the webpage with the url security tool? Can you explain more? I have all patches current. How can they do that?

by curacao_dejavu

You have to delete the space that came in on the previous post to the link of the lockdown tool. Sometimes it happens when posting a reply.
anyway here is another link.
http://www.microsoft.com/downloads/details.aspx?FamilyID=dde9efc0-bb30-47eb-9a61-fd755d23cdec&DisplayLang=en

or go to ms downloads and search and download :IIS Lockdown Tool 2.1"

They use scripts or something like that , in the logfile you will see the link to your page and some executables trying to get in.

Blacj is a personal firewall, i will work buit if you have like 5 servers or so you have to go through all servers if somethings happens.
with a corporate firewall your server will be on your internal network and thus never exposed to the internet. Only the service that you want (web, ftp, terminal server in my case , etc, will be forwarded to the internal network and thus your servers will be much better protected.

Leopold

by mark

Thanks for the comments, but they did not help me. For those interested I came up with 2 helps. To keep the remote logins from happening, my ISP actually suggested he block ports 135, 137, 138, 139 and 445, both tcp and udp at his router level for all my IPs. He said that will keep SMB out. For a firewall solution, the best I found (but have not tried yet) is http://smoothwall.org. This is a freeware OS that you load on a standard x86 PC with multiple NICs and performs firewalling that is managed thru an HTML interface. Looks like the ticket to me. Thanks for the responses.

This discussion is closed to new replies.