Re: Attempt Attack

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 06/10/05 

Date: Fri, 10 Jun 2005 10:27:37 -0500

You would need to check the firewall logs for IP addresses using the port of
the service they are trying to logon to that match the time of the logon
failures. Of course for this to work well the times of the firewall and the
computer/domain controller will need to be in synch. I would think your
proxy has some logging capability as it may be your firewall. Software
firewalls [Sygate for example] or software IDS will usually be able to
record the IP addresses but then you would have to install more software on
your proxy server. You can also use netmon to monitor traffic on the
external adapter but that will probably necessitate that you capture a lot
of traffic unless these attempts are very time specific and that can be
very tedious.

Failed logon attempts are not unusual and if you are enforcing strong
passwords then the risk is minimal unless they are trying to mount a denial
of service attack. I would also make sure that file and print sharing and
netbios over tcp/ip are disabled on the external adapter of the proxy
connected directly to the internet. Depending on what you are offering to
internet clients [remote users, etc] you may want to look at the possibility
of using VPN using l2tp for access. Since you are using proxy it will need
to be NAT-T compliant however as would the l2tp VPN clients [no problem for
Windows since W98 with the NAT-T client installed] . L2tp requires the use
of computer certificates so that computers can authenticate before the user
is allowed to try and logon. --- Steve

"Reyman" <reystuff@gmail.com> wrote in message
news:1118412801.138644.273300@g44g2000cwa.googlegroups.com...
>I have a windows 2000 machines we use as a proxy server that sits in
> the DMZ. For a while, I have been noticing computers from domains
> unreachable by me trying to login to the machine using an account that
> is disabled. Before they find and and attempt to use an active
> account, is there a way for us to find out the IP of the computers that
> are attempting this attack? Any software we can install on this machie
> that would block attempts like this?
>
> Thanks.
>

Relevant Pages

  • Re: am I being hacked or is something else going on?
    ... Are you on a local network with other computers? ... Type 3 logon means someone is trying ... Do you have any holes open in your firewall to offer ... print sharing if you are not offering shares to other computers on a network. ...
    (microsoft.public.win2000.security)
  • Re: Anonymous login
    ... group info from your computers. ... tcp/ip on nic exposed to the internet with no firewall. ... The Logon type is 3. ... > The network is on a cable DSL, a Rep at a seminar had told me that cable ...
    (microsoft.public.win2000.security)
  • Re: Proxy with PIX
    ... I have lots of computers behind the firewall, ... so I would prefer to use the proxy without ... any configuration on the client side. ...
    (comp.dcom.sys.cisco)
  • Re: What does a firewall do?
    ... would be more appropriate for the applications to do the filtering instead. ... This type of firewall makes the most sense, ... computer which runs these proxy programs be any less vulnerable than the ... firewall computers are actually a juicy target for the attacker? ...
    (comp.security.firewalls)
  • Re: ISA SERVER NOT STARTING
    ... I delete the nat/basic firewall and stop and started the RRAS an tried to ... There were no critical events in the DNS Server Log in the last 24 hours. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)