MSFTP

[anothracount]

I am getting these in my logs on a webserver running windwos 2003 server. I m not sure how i can log their ip address.
The server was unable to logon the Windows NT account 'webmaster' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.

Thanks for your help in advanced.

 

[PScottC]

Logging should be enabled by default. IP of the source will be found in a log file in %systemroot%\system32\logfiles\ftpsvc.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[anothracount]

Thanks, i should of toughth of that.. the problem is someone on a weekely basis trys different username and passwords trying to hack into our ftp. i just enabled ip security since it is not a public ftp server rather a websserver.
Thanks a lot. and nice signature

 

[PScottC]

If the FTP portion of your IIS installation is not meant for public consumption, I would suggest configuring it to only accept inbound connections from known IP Addresses.

FTP Site Properties --> Directory Security Tab --> "Denied Access" radio button.

Then add the IP ranges of your internal network. (For a box in a colo, add the IP's of your firewall)

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers