Locate internal Hacker by IP address?

[Brianc2k]

We have a hacker who is attempting to login as Admin late in the evening. I have been able to determine that the attempts are not coming through our Gateway/Router. Therefore the attempts are taking place on one of the computers within the school.

We have assigned IP addresses for all systems. Can I audit the Admin account and learn which workstation IP address the hacker is using? Or, is there another tool I can use to find this individual?

I feel the Admin password is secure and has not been compromised. But I still need to find this person and terminate these attempts. Any suggestions would be helpful Thanks.

 

[TheLad]

Look at the Admin account in NwAdmin under Intruder Lockout. It should tell you the last address where login was unsuccessful. You should be able to trace it from there. -----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------

 

[Brianc2k]

The Admin account remains locked. It was reset at 1/23/02 about an hour later then the hack attempt. The last address where login was unsuccessful is blank.

I will unlock the admin account and hope that next time an entry will be there. If all goes with the trend another attempt will be made in the next two nights. I will post the results.

 

[theripper]

Brianc2K -

There's a program called Proactive NDS Control. I haven't personally tried it, but may be something that could really help you out in a school environment. Tracks failed logins, deletions, security = to me additions, NDS object creation. . . tons of stuff.

http://www.visualclick.com/content/proactivendscontrol.htm

Good Luck ~

 

[Brianc2k]

Another attempt was made last night 9:33 pm. Again there is no IP address in the Intruder Lockout screen through NDS. We have a Citrix server that is used for keyboarding class only. It serves 24 students. This morning I had a license error on the server. It warned me I was getting close to the maximum licenses and the workstations were physically turned off. No one else was in the building yet. That Citrix server bridges over to NDS so the students can get to their files. I wonder if the Citrix server has been hacked and someone is trying to get into our NetWare from that side.

Thanks Theripper. I will look into that software today. Once I do find the solution I will post. If any one else has any ideas please respond. Thanks.

 

[Guest_imported]

there is also away, however i am unsure how to do it. you can setup up novell so that you can only login to the admin account from a single computer. you do this by telling it to only let you login from that ip i think.

 

[TheLad]

What painiest is suggesting is by setting Network Address Restrictions you can restrict where the Admin account can log in. However, if you want to do this, I would very strongly suggest configuring upto five machines where the admin account can log onto. If a single machine is configured and that machine fails for any reason, do you want to risk not being able to log into your admin account?? -----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------