Re: External connection using port 3389
From: Steven Umbach (n9rou_at_n0spam-comcast.net)
Date: 02/03/04
- Next message: Tom Pepper Willett: "Re: Microsoft Security Bulletin Release for February 2, 2004"
- Previous message: Tedd Riggs: "Re: Microsoft Security Bulletin Release for February 2, 2004"
- In reply to: BG: "External connection using port 3389"
- Next in thread: BG: "Re: External connection using port 3389"
- Reply: BG: "Re: External connection using port 3389"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 03 Feb 2004 00:14:11 GMT
That is Terminal Services/Remote Desktop server connection. I believe if you
look in Terminals Services Manager, you should be able to see who is connected.
If that server is not a Terminal Server, then somebody is probably connected
with administrator credentials. It could be a legitimate connection if Remote
Desktop is used to manage that server and possibly the connection is still
logged on from a connection that was not terminated properly. Access to port
3389 tcp should be blocked at the perimeter firewall unless access is desired in
which case it is best to configure the firewall to accept connections only from
certain allowed public IP addresses belonging to those who are allowed to manage
it or better yet use a vpn connection for access. Enabling auditing of logon
events, using complex passwords, renaming the built in administrator account,
and having an account lockout policy should also be implemented to help prevent
hacks from Remote Desktop connections and attacks in general. --- Steve
"BG" <bg2@uasystem.ua.edu> wrote in message
news:emYN8Ce6DHA.2572@TK2MSFTNGP09.phx.gbl...
> netstat -a on a Windows2003 server shows a connection on port 3389 from an
> outside domain address. This sounds like an intrusion to me. Any and all
> feedback appreciated.
>
>
- Next message: Tom Pepper Willett: "Re: Microsoft Security Bulletin Release for February 2, 2004"
- Previous message: Tedd Riggs: "Re: Microsoft Security Bulletin Release for February 2, 2004"
- In reply to: BG: "External connection using port 3389"
- Next in thread: BG: "Re: External connection using port 3389"
- Reply: BG: "Re: External connection using port 3389"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
