RE: Failed admin logins

From: McKee, Graydon (Graydon.McKee_at_unisys.com)
Date: 11/21/04

  • Next message: Corey Watts-Jones: "RE: Securing Printers" 
    Date: Sat, 20 Nov 2004 19:19:43 -0500
To: <security-basics@securityfocus.com>

    Understanding that my suggestion may not always be possible - pull the plug and
    wait to see who screams. Outside of that you could check the audit logs as has
    been suggested or sniff the packets going to that machine and isolate who is
    communicating with that box with the logs of when the login occurs. Once you
    know who is talking you can then examine that box to see what would need to
    interact with the server in question.

    Graydon McKee - GSEC
    Senior Security Architect, Federal Information Security Practice
    Unisys US Federal Government Group
    Office: 703-439-5991 Fax: 703-439-3216
    Mobile: 240-472-7148

    I have recently changed my digital signature, please update your settings if you
    have saved my previous one. Thank You.

     

    -----Original Message-----
    From: GuidoZ [mailto:uberguidoz@gmail.com]
    Sent: Friday, November 19, 2004 6:01 AM
    To: Joe Quigley
    Cc: security-basics@securityfocus.com
    Subject: Re: Failed admin logins

    Is auditing enabled (or possible)? By auditing failed attempts, then
    checking the logs in the event viewer, it should lead you right to the
    source. 

    --
Peace. ~G
On Thu, 18 Nov 2004 13:30:33 -0500, Joe Quigley
<jquigley@iir-central.com> wrote:
> Hello,
> 
> I have a machine that is trying to log in as the domain administrator
> but can't figure out what application/service is doing it. I've checked
> all the services that login as administrator (yes, very bad idea to use
> admin for services, I inherited this setup) but that does not seem to be
> the problem as the services start. I even retyped the password in the
> services applet just to be sure. Anyone have any thoughts on how to
> track down the source of this rogue login??
> 
> Thanks in advance,
> 
> Joe
> 
>

  • Next message: Corey Watts-Jones: "RE: Securing Printers"

    Relevant Pages

    • Re: Auto Populating Blocked IPs List
      ... I just checked my security logs - which I save - and I see ... The earlies attacks were trying to almost invariably login as ... >IP blocks their ISP is handing out and allow only those. ... Bill Vermillion - bv @ wjv. ...
      (comp.unix.bsd.freebsd.misc)
    • Re: Last Login
      ... The table "tblLastLogin" gets updated when ... intCount gets successfully populated with the number of stories since last ... login but intLastLogin does not get updated, ... If it gets updated as soon as the publisher logs in, ...
      (microsoft.public.access.queries)
    • Re: sshd authentication failure message
      ... >> happen with every login, at least remote, although the user logs in ... > the rpm. ... > I think it is a function of how many people actually look at the logs ... > If there is a fix as well as stopping the login delay on a successful ...
      (RedHat)
    • Re: Account Lockout Policies
      ... Allowing accounts to remain dormat for 30 days ... If a technical solution is unavoidable due to a lack of management buy-in, ... Extract login details from the security logs. ...
      (microsoft.public.security)
    • A javascript problem,help!
      ... The problem is described below:(Use IE6) ... automatically.However,something perplexs me.When I login the computer ... Could ANYONE give suggestion about solving the problem?(the HTML cannot ...
      (comp.lang.javascript)