Networks

Ask something
Discussion Locked

Hacking NT from NetScape Enterprise Srvr

0 helpful
2 replies

by jheineman

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

we have a PROBLEM with someone running a DOS based pc restart utility from outside the company. we use a private IP address but have NAT for our NW 5.1 Netscape webserver which acts as our GroupWise web access piece. it looks like the utility was run by someone logged into an NTDS Domain as administrator. after terminating our lan manager we changed the account password, but since have found atomic.log keylogger installed on two NT servers. our guess is the attacks are coming from an unplugged VPNS hole, but i want to make certain that the NetWare 5.1 server and Netscape aren't a potential hole. has anyone experience with this? thanks
Jerry Heineman
Sr. Network Manager
Crain Communications
313.446.6093

2 replies

by jschein

Set a new firewall policy.. BLOCK ALL PORTS... monitor and read the log overnight of what ports were actively trying to communicate out / in. Block the ports that are not related to work...

by blah, i hate ms

Netscrape Enterprise server has been dropped by Novell. They now have Apache 2.0 which is downloadable free from their site. Apache is far more secure and is run on more than 50% of the worlds webservers. You will have to reinstall the Groupwise Webaccess portion for this to work. Apache is only realy supported on GW6 and above, but with a little frigging it can be made to work on GW55. I would be supprised if the problem is netscape, you need to isolate as suggested above where the hole is before you can plug it.

This discussion is closed to new replies.