Re: Finding out admin username
From: NeoSadist (neos@dist)
Date: 10/13/02
- Next message: Roger Jennings: "Microsoft Test X.509 Certs Expire 11/02/2002"
- Previous message: Shanahan: "Re: Securiy Templates"
- In reply to: SvS: "Finding out admin username"
- Next in thread: BloodRed: "Re: Finding out admin username"
- Reply: BloodRed: "Re: Finding out admin username"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "NeoSadist" <neos@dist> Date: Sun, 13 Oct 2002 10:13:18 -0600
"SvS" <sevims@olisys.com> wrote in message
news:u93Gt0ocCHA.1700@tkmsftngp10...
> Guys, I've been maintaining couple of Windows 2000 Advanced Servers and
> using terminal services to administer them. Since terminal service is wide
> open to internet, I decided to log the bad username/password attempts to
> it. One result really scared the hell out of me.. I'm using very unique
> administrator username , (I changed the administrator account username )
and
> a very unique password to it.
> I was going thru the logs today and noticed that somebody from outer
> internet, knew my admin username!!!!.. From the logs I can only see the
> usernames and the IP addresses of the user connecting from. I can't see
what
> password he tried, but he definitely knew my admin username which he MUST
> have extracted from somewhere.. There is absolutely no way, I mean NO WAY
he
> could guess it...
> Now, I'm curios if there is a bug in my server. All the security patches
> everything is upto date. But I guess this is not enough, Anybody have an
> idea, how might be this happening ?
> Thank you in advance,
>
> PS : Servers have netbios ports are opened but no anonymous access is
> allowed. Shared to everyone however.
>
>
>
I'd say use a firewall, and also make sure ALL your machine's lan manager
setup in the local security policy is set to NTLM replies only.
Also, I'd say, if your entire network is win2k or above, including the
server, just use tcp (no installed netbios protocol) but set it to use
netbios over tcp.
I'm not familiar with corporate networks, but I'd talk to symantec and/or
read some stuff from www.sans.org 's reading room.
- Next message: Roger Jennings: "Microsoft Test X.509 Certs Expire 11/02/2002"
- Previous message: Shanahan: "Re: Securiy Templates"
- In reply to: SvS: "Finding out admin username"
- Next in thread: BloodRed: "Re: Finding out admin username"
- Reply: BloodRed: "Re: Finding out admin username"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
