FTP Server HELP!!!

An unknown user used a program to try to script through about 8 different
usernames, and like 300 passwords each in attempts to hack my FTP Server on
my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in case"
backup admin account. I try to never use admin privledges on the server,
and with the negative implications of following the recommendations to
rename Administrator, I have hesitated to do so, however after 300 failed
login attempts, the Administrator account was locked out. Now I've
recovered my access to my system, but I have some "obscurity" goals I'd like
to try.

I have found the following and implemented it:
http://support.microsoft.com/default.aspx?scid=kb;en-us;826270

Now I would like my FTP SVC to at the least broadcast external.domain.com
rather than server.domain.local on the "Connected to:" line. Any other
recommendation on securing my "Read Only" FTP server would be greatly
appreciated.

Thanks,

SuperGumby
Mon Sep 19 18:40:56 CDT 2005

yeah, remove IIS FTP and install a third party FTP service which uses it's
own account database.

"MCSEGURU" <mcseguruhere@aol.com> wrote in message
news:uWVpXMXvFHA.3100@TK2MSFTNGP12.phx.gbl...
> An unknown user used a program to try to script through about 8 different
> usernames, and like 300 passwords each in attempts to hack my FTP Server
> on my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in
> case" backup admin account. I try to never use admin privledges on the
> server, and with the negative implications of following the
> recommendations to rename Administrator, I have hesitated to do so,
> however after 300 failed login attempts, the Administrator account was
> locked out. Now I've recovered my access to my system, but I have some
> "obscurity" goals I'd like to try.
>
> I have found the following and implemented it:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;826270
>
> Now I would like my FTP SVC to at the least broadcast external.domain.com
> rather than server.domain.local on the "Connected to:" line. Any other
> recommendation on securing my "Read Only" FTP server would be greatly
> appreciated.
>
> Thanks,
>

MCSEGURU
Mon Sep 19 18:52:38 CDT 2005

Don't you think MS should provide the resources to configure server
obscurity to the general public? I understand the argument to keep it in
"conformance" by default, but for those who are intersted in configuring
these things, my impression of why the Metabase is configurable in 2003, the
tools, feature sets should be available, no?

I feel obligated to the MS people to present the weaknesses of their product
(SBS, the all inclusive product that has it all, or so they think), and hope
they respond with at least their philosophy for not choosing to allow us the
flexibility.

It seems to me that the MSFTPSVC should be able to restrict logon based on
Group Membership, or specifically configured users? That would make things
much better. They did this for Remote Desktop in 2003. So that cures the
Account DB part, and the only thing left is the "Connected to:" option, that
if they were using the CEICW tool to it's fullest extent, it would configure
the SMTP response, the cert hostname, AND the FTPSVC. I mean why not? Talk
about a harvest vulnerability.

Now I know that there are much better FTP products, but with all the
advances MS is making, I think it's worth their interest in this thread to
at least ponder the options of adding the features.

Thanks,
Jeff

"SuperGumby [SBS MVP]" <not@your.nellie> wrote in message
news:uUYXWOXvFHA.2948@TK2MSFTNGP15.phx.gbl...
> yeah, remove IIS FTP and install a third party FTP service which uses it's
> own account database.
>
> "MCSEGURU" <mcseguruhere@aol.com> wrote in message
> news:uWVpXMXvFHA.3100@TK2MSFTNGP12.phx.gbl...
>> An unknown user used a program to try to script through about 8 different
>> usernames, and like 300 passwords each in attempts to hack my FTP Server
>> on my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in
>> case" backup admin account. I try to never use admin privledges on the
>> server, and with the negative implications of following the
>> recommendations to rename Administrator, I have hesitated to do so,
>> however after 300 failed login attempts, the Administrator account was
>> locked out. Now I've recovered my access to my system, but I have some
>> "obscurity" goals I'd like to try.
>>
>> I have found the following and implemented it:
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;826270
>>
>> Now I would like my FTP SVC to at the least broadcast external.domain.com
>> rather than server.domain.local on the "Connected to:" line. Any other
>> recommendation on securing my "Read Only" FTP server would be greatly
>> appreciated.
>>
>> Thanks,
>>
>
>

IWSEC
Tue Sep 20 13:29:04 CDT 2005

Hi,
Here's some suggestions:

1. Edit the local security policy and only allow the specific accounts (or
groups) that need to be able to access the server over a network.
2. Once you have renamed your admin account, create another account called
Administrator and give it no rights or permissions. That way a hacker wastes
his time trying to break what he thinks will give him admin permissions.
Hopefully you will see this traffic in the logs and could block his IP
address.
3. Do you need FTP to be available to anywhere or is there only specific
fixes IP addresses that will access it? If so tie down the firewall to only
allow FTP to those specific addresses.
4. Make sure your FTP root is configured for specific accounts only and no
anonymous logons are allowed.

Hope that helps!

Cheers IWSEC
www.iwsec.co.uk

"MCSEGURU" wrote:

> An unknown user used a program to try to script through about 8 different
> usernames, and like 300 passwords each in attempts to hack my FTP Server on
> my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in case"
> backup admin account. I try to never use admin privledges on the server,
> and with the negative implications of following the recommendations to
> rename Administrator, I have hesitated to do so, however after 300 failed
> login attempts, the Administrator account was locked out. Now I've
> recovered my access to my system, but I have some "obscurity" goals I'd like
> to try.
>
> I have found the following and implemented it:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;826270
>
> Now I would like my FTP SVC to at the least broadcast external.domain.com
> rather than server.domain.local on the "Connected to:" line. Any other
> recommendation on securing my "Read Only" FTP server would be greatly
> appreciated.
>
> Thanks,
>
>
>

MCSEGURU
Tue Sep 20 19:49:23 CDT 2005

Great Tips.

Most have been implemented. I do leave it open, mostly for my own access
convenience while traveling (althougth VPN would be safer, other peoples
Firewalls can make this a challenge at times). FTP root-dir has no write
access at all. Only one "hidden" vir-dir has write access, and it's limited
to only one account. Anonymous access has been disallowed, although I've
thought of creating an anonymouse Vir-Dir with read-only access for a honey
pot. However, I am unsure if the anonymous would be able to traverse parent
paths, and elevate ones self. That much "hacking" knowledge I'm afraid I
don't have.

Thanks.



"IWSEC" <IWSEC@discussions.microsoft.com> wrote in message
news:890E49E5-0540-4205-A785-7C2A687A17D4@microsoft.com...
> Hi,
> Here's some suggestions:
>
> 1. Edit the local security policy and only allow the specific accounts (or
> groups) that need to be able to access the server over a network.
> 2. Once you have renamed your admin account, create another account called
> Administrator and give it no rights or permissions. That way a hacker
> wastes
> his time trying to break what he thinks will give him admin permissions.
> Hopefully you will see this traffic in the logs and could block his IP
> address.
> 3. Do you need FTP to be available to anywhere or is there only specific
> fixes IP addresses that will access it? If so tie down the firewall to
> only
> allow FTP to those specific addresses.
> 4. Make sure your FTP root is configured for specific accounts only and no
> anonymous logons are allowed.
>
> Hope that helps!
>
> Cheers IWSEC
> www.iwsec.co.uk
>
> "MCSEGURU" wrote:
>
>> An unknown user used a program to try to script through about 8 different
>> usernames, and like 300 passwords each in attempts to hack my FTP Server
>> on
>> my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in
>> case"
>> backup admin account. I try to never use admin privledges on the server,
>> and with the negative implications of following the recommendations to
>> rename Administrator, I have hesitated to do so, however after 300 failed
>> login attempts, the Administrator account was locked out. Now I've
>> recovered my access to my system, but I have some "obscurity" goals I'd
>> like
>> to try.
>>
>> I have found the following and implemented it:
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;826270
>>
>> Now I would like my FTP SVC to at the least broadcast external.domain.com
>> rather than server.domain.local on the "Connected to:" line. Any other
>> recommendation on securing my "Read Only" FTP server would be greatly
>> appreciated.
>>
>> Thanks,
>>
>>
>>

IWSEC
Wed Sep 21 05:28:04 CDT 2005

Hi,
It all sounds good - yup VPN's would be better and yup they are a complete
pain with other peoples firewalls, I gave up a while ago. Another couple of
things you could think about (please ignore if you have already done this):

1. Enable the Account Lockout and Account Lockout Threshold in your local
security policy. I have mine set fairly loose at 10 invalid logon attempts
and locked out for 30mins - I reason that if anyone types their password in
wrongly over 10 times they deserve to have to wait half an hour to try again!
But it does stop password crackers etc from being able to hammer your server
for hundreds of attempts a minute.
2. Enable Password Complexity in the local security policy


Cheers
IWSEC
www.iwsec.co.uk

"MCSEGURU" wrote:

> Great Tips.
>
> Most have been implemented. I do leave it open, mostly for my own access
> convenience while traveling (althougth VPN would be safer, other peoples
> Firewalls can make this a challenge at times). FTP root-dir has no write
> access at all. Only one "hidden" vir-dir has write access, and it's limited
> to only one account. Anonymous access has been disallowed, although I've
> thought of creating an anonymouse Vir-Dir with read-only access for a honey
> pot. However, I am unsure if the anonymous would be able to traverse parent
> paths, and elevate ones self. That much "hacking" knowledge I'm afraid I
> don't have.
>
> Thanks.
>
>
>
> "IWSEC" <IWSEC@discussions.microsoft.com> wrote in message
> news:890E49E5-0540-4205-A785-7C2A687A17D4@microsoft.com...
> > Hi,
> > Here's some suggestions:
> >
> > 1. Edit the local security policy and only allow the specific accounts (or
> > groups) that need to be able to access the server over a network.
> > 2. Once you have renamed your admin account, create another account called
> > Administrator and give it no rights or permissions. That way a hacker
> > wastes
> > his time trying to break what he thinks will give him admin permissions.
> > Hopefully you will see this traffic in the logs and could block his IP
> > address.
> > 3. Do you need FTP to be available to anywhere or is there only specific
> > fixes IP addresses that will access it? If so tie down the firewall to
> > only
> > allow FTP to those specific addresses.
> > 4. Make sure your FTP root is configured for specific accounts only and no
> > anonymous logons are allowed.
> >
> > Hope that helps!
> >
> > Cheers IWSEC
> > www.iwsec.co.uk
> >www.iwsec.co.uk/frontpage
>>
> > "MCSEGURU" wrote:
> >
> >> An unknown user used a program to try to script through about 8 different
> >> usernames, and like 300 passwords each in attempts to hack my FTP Server
> >> on
> >> my SBS 2003 Premium Server. Dilema, I hadn't ever created a "just in
> >> case"
> >> backup admin account. I try to never use admin privledges on the server,
> >> and with the negative implications of following the recommendations to
> >> rename Administrator, I have hesitated to do so, however after 300 failed
> >> login attempts, the Administrator account was locked out. Now I've
> >> recovered my access to my system, but I have some "obscurity" goals I'd
> >> like
> >> to try.
> >>
> >> I have found the following and implemented it:
> >> http://support.microsoft.com/default.aspx?scid=kb;en-us;826270
> >>
> >> Now I would like my FTP SVC to at the least broadcast external.domain.com
> >> rather than server.domain.local on the "Connected to:" line. Any other
> >> recommendation on securing my "Read Only" FTP server would be greatly
> >> appreciated.
> >>
> >> Thanks,
> >>
> >>
> >>
>
>
>