scan of domain logon reveals unknown port

From: Dan Larsen (drlarsen77_at_hotmail.com)
Date: 08/16/03

  • Next message: Kayne Ian (Softlab): "RE: Account Lockout -- ARGH" 
    To: <focus-ms@securityfocus.com>
Date: Fri, 15 Aug 2003 15:22:29 -0700

    Hello,

    After having one of my fully patched Win2k/IIS5 web servers hacked, I had
    decided to enable Routing and Remote Access restricting only traffic to
    ports I determined were necessary.

    After spending much time researching, I configured Routing and Remote Access
    only to find that when logging in using my Domain Administrator account, I
    was now greeted with a lengthy (approx 15 minute) delay at the "Loading your
    personal settings" window.

    Rechecking my settings revealed no missed entries, so I decided to install
    Ethereal to find out exactly what was going on. Interestingly enough, I
    discovered that during the logon process there was some TCP communication
    between the Win2k DC / DNS server and the IIS web server on port 1026.

    I enabled incoming and outgoing traffic for all packets originating from, or
    going to, port 1026 and my login delay is gone. However, I wasn't able to
    find anything anywhere explaining what this communication on port 1026 is
    for. Also, I would have expected it to be below the 1024 range.

    Can anybody shed some light on what is going on here? I'd like to move ahead
    and lock down all my servers in a similar fashion, however I'd like to know
    what port 1026 is and if I can rely on that traffic always being on the same
    port. If not, I'm hoping to find out how I can configure Routing and Remote
    Access to allow proper communication with the DC.

    Below is a list of the ports I have opened and what I believe their function
    is. I have configured the routing for all traffic to/from the ports listed.

    Thanks for any help you can provide.

    Regards,
    Dan

    21 TCP FTP
    25 TCP SMTP
    53 TCP UDP DNS
    80 TCP HTTP
    88 TCP UDP Kerberos Secure Authentication
    135 TCP MS Networking
    137 UDP MS Networking
    138 UDP MS Networking
    139 TCP MS Networking
    389 TCP LDAP
    443 TCP SSL
    445 TCP NetBIOS over TCP/IP
    464 TCP UDP Kerberos Password
    3268 TCP MS Global Catalog
    3269 TCP MS Global Catalog w/ LDAP/SSL
    3389 TCP RDP
    1026 TCP Unknown?

    ---------------------------------------------------------------------------
    Your network firewall and IDS products do not prevent Web application
    attacks - the most common form of online exploitation- resulting in Web
    defacement, data theft, sabotage and fraud.
    KaVaDo is the only company that provides a complete suite of Web
    application security products.
    Download a FREE whitepaper on "Security Policy Automation for Web
    Applications":http://www.securityfocus.com/Kavado-focus-ms
    ---------------------------------------------------------------------------

  • Next message: Kayne Ian (Softlab): "RE: Account Lockout -- ARGH"

    Relevant Pages

    • Re: PC Anywhere
      ... routing and remote access ... >> one for port 5631 point it to the IP address of the work station you want ... I went into Administrative Tools> Routing and Remote Access and, ...
      (microsoft.public.windows.server.sbs)
    • Re: Proper Router Routing, Two IP addresses?
      ... If you wanted to make the SBS web services available to its domain users from outside the network on HTTP, port 80 and you also wanted to run a public web server then the only safe way would be to use two separate machines, isolated from each other, and you would have no option but to use two different IP addresses. ... The server's integrated NIC goes into the hub, and it's NIC card goes to the router. ... It's almost always web servers which people want more than one of, and it's perfectly possible to run multiple web servers on one machine, if a router is redirecting port 80 on different public addresses to different ports on an internal machine, or of course to different NICs. ...
      (microsoft.public.windows.server.sbs)
    • Re: PC Anywhere
      ... if you have ISA you don't have the basic firewall anymore. ... > What I see under the IP Routing is: ... >>>> one for port 5631 point it to the IP address of the work station you ... I went into Administrative Tools> Routing and Remote Access ...
      (microsoft.public.windows.server.sbs)
    • AW: Secure those servers
      ... Subject: AW: Secure those servers ... > where it gets foggy for me) then another firewall with open ... > the web servers to talk to the other servers, ... the outer firewall should be configured to let through port 80 to the cache. ...
      (Security-Basics)
    • Re: Routing and Remote Access port fowarding does not work
      ... They access the Internet thru the server using Routing and Remote Access. ... I have noticed none of my port forwarding is working so I disabled ...
      (microsoft.public.win2000.general)