Break in attempts

[Kimosabi2]

SBS2003 R2 system getting System Event Code:100 Warnings and Security Event Code:529 Warnings. I am getting up to 2000 log entries a day indicating that an attempt to login as Administrator in being made. What can I do about the attempts?

Bob...

 

[wahnula]

I have had this problem in the past. Best practice is to create a new user, give it Admin access and a super-secure password (or passphrase), test it to make sure it's working properly, then disable the Administrator account.

Tony

Users helping Users...

 

[Kimosabi2]

Thanks for the input. Sounds like a good plan.

 

[ShackDaddy]

It might just be that there is a service on your server that was originally set up to run under the Admin account, and then you changed the Admin password. It will then trigger many many many failed login errors like you are describing... This is fairly likely.

Another option that some people use is to just change the admin account to a user's name. Like Kizer Sose or something you will remember. That protects it from anyone out there who decides to just hammer on the Admin account.

Dave Shackelford
Shackelford Consulting

 

[Kimosabi2]

Dave,
Thank for the reply.
The breakins were traced to the FTP server account.I disabled the FTP service until I need it.

Bob...

 

[ShackDaddy]

Ah... someone scanned your network and found the ftp server port listening, so it decided to spend a day knocking...

Dave Shackelford
Shackelford Consulting

 

[phillid2]

I get a lot of FTP attacks - mostly from Asia and a few from Europe. If it is an US IP, and it filled my log file, I report it to the ISP's abuse address. I have hear back so I assume I am just wasting my time.


Don Phillips

http://worthingtonengineering.com