SBS FTP service getting slammed.

We have a low IT budget. I am using FTP to backup remote computers.

Someone discovered my FTP service was opened and has been hitting me with
10's of thousands break-in attempts. Usually trying the administrator user.

They will probably not figure out the user name, because I have changed the
admin username, but it is almost everyday.

Yesterday they tried the username of "Julian" Go figure. The police here
won't do anything. Neither will my ISP.

Any ideas?

Thanks!

Phillip
Tue May 16 12:08:27 CDT 2006

"Purtech" <mikek(remove)@hlit.net> wrote in message
news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
> Yesterday they tried the username of "Julian" Go figure. The police here
> won't do anything. Neither will my ISP.

There isn't anything that can be done. And there isn't anything to do.
They are failing,...that is what is supposed to happen.
You can't stop them from trying.
Just make sure you have very strong complex passwords.

Your ISP can't do anything about it if they wanted to and neither can the
police. How are thy supposed to arrest people who may be in some other
country somewhere where they have no jurisdiction? Only the guilty party's
ISP is capable of doing anything about it,...if you can figure out who that
is,...figure out how to contact them,...prove to them that something is
really happeing,...and if they are actually even willing to do anything
about it.

Rest assured everybody else's FTP Server out there is getting the same
thing. Heck I even set on up once and waited to see what they would upload
just for fun. I ended up collecting some a few DivX AVIs of the Smallville
TV Series, unfortuneatly it wasn't in English :-)
It only took a few hours for them to find my fresh new FTP Server that had
not been there before.

Some precautions you can take.

1. Store the FTP Root on a separate drive (partion). If they finally manage
to login they will upload crap with odd names that the Windows OS is not
capable of deleting. To fix that quickly you simply move the good stuff to
another partion,..reformat the FTP partition,...then move the good stuff
back. That usually only takes a few minutes. But if you have the FTP Root
on a partion with other stuff it becomes more difficult,...if it is the C:
partion with the OS you are really screwed.

2. You could add the MS Loopback adapter and assing it a private IP# that is
*not* used on your LAN,...bind the FTP Site to that IP *only*. Then setup
the Server to accept Remote Access VPN. Then you VPN into it first,...then
run the FTP to the Private IP# over the VPN instead of exposing it to the
Internet. This will protect the fact the FTP passes the credentials in
Clear Text.

Create a local User Account on the Server (with a complex password!). Create
a new Group for the User then make it the Default Group for the User and
remove the User from the normal Users Group. Give this user "dialin"
rights,...this means they can establish the VPN connection but will have no
permissions to anything else beyond that. You use this account the
establish your VPN. Then use the separate FTP User for logging into the FTP
Site while shielded inside the VPN Tunnel.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/prodtechnol/isa/2004/deploy/dgisaserver.mspx
-----------------------------------------------------

Purtech
Tue May 16 12:25:08 CDT 2006

Phillip:

I assumed not much could be done, but thought I would ask.

Thanks for all the advise it does help.

Do you think assigning static IP to the external machines and only allowing
those to authenticate will cut down on it too? Or does it have a weakness
too?

VPN not an option right now.

Mike


"Phillip Windell" <@.> wrote in message
news:OprcatQeGHA.1272@TK2MSFTNGP03.phx.gbl...
> "Purtech" <mikek(remove)@hlit.net> wrote in message
> news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
>> Yesterday they tried the username of "Julian" Go figure. The police here
>> won't do anything. Neither will my ISP.
>
> There isn't anything that can be done. And there isn't anything to do.
> They are failing,...that is what is supposed to happen.
> You can't stop them from trying.
> Just make sure you have very strong complex passwords.
>
> Your ISP can't do anything about it if they wanted to and neither can the
> police. How are thy supposed to arrest people who may be in some other
> country somewhere where they have no jurisdiction? Only the guilty
> party's
> ISP is capable of doing anything about it,...if you can figure out who
> that
> is,...figure out how to contact them,...prove to them that something is
> really happeing,...and if they are actually even willing to do anything
> about it.
>
> Rest assured everybody else's FTP Server out there is getting the same
> thing. Heck I even set on up once and waited to see what they would upload
> just for fun. I ended up collecting some a few DivX AVIs of the Smallville
> TV Series, unfortuneatly it wasn't in English :-)
> It only took a few hours for them to find my fresh new FTP Server that had
> not been there before.
>
> Some precautions you can take.
>
> 1. Store the FTP Root on a separate drive (partion). If they finally
> manage
> to login they will upload crap with odd names that the Windows OS is not
> capable of deleting. To fix that quickly you simply move the good stuff to
> another partion,..reformat the FTP partition,...then move the good stuff
> back. That usually only takes a few minutes. But if you have the FTP Root
> on a partion with other stuff it becomes more difficult,...if it is the C:
> partion with the OS you are really screwed.
>
> 2. You could add the MS Loopback adapter and assing it a private IP# that
> is
> *not* used on your LAN,...bind the FTP Site to that IP *only*. Then setup
> the Server to accept Remote Access VPN. Then you VPN into it first,...then
> run the FTP to the Private IP# over the VPN instead of exposing it to the
> Internet. This will protect the fact the FTP passes the credentials in
> Clear Text.
>
> Create a local User Account on the Server (with a complex password!).
> Create
> a new Group for the User then make it the Default Group for the User and
> remove the User from the normal Users Group. Give this user "dialin"
> rights,...this means they can establish the VPN connection but will have
> no
> permissions to anything else beyond that. You use this account the
> establish your VPN. Then use the separate FTP User for logging into the
> FTP
> Site while shielded inside the VPN Tunnel.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/ISA2004_AccessRules.html
>
> Troubleshooting Client Authentication on Access Rules in ISA Server 2004
> http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
> http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
>
> Deployment Guidelines for ISA Server 2004 Enterprise Edition
> http://www.microsoft.com/technet/prodtechnol/isa/2004/deploy/dgisaserver.mspx
> -----------------------------------------------------
>
>
>

Steven
Tue May 16 13:22:10 CDT 2006

Are you using any sort of firewall either software or hardware?? If so and
the failed logon attempts are coming from a relatively few IP source
addresses you can try to blacklist them and add then to a firewall rule that
blocks any access from those IP addresses to your network. If nothing else
you could create an ipsec filter policy to do such. Also consider
configuring your firewall to allow access only from/to the IP address of the
remote computers assuming they have static IP addresses. The link below
explains a basic ipsec filtering policy that uses permit and block filter
actions.. --- Steve

http://www.securityfocus.com/infocus/1559

"Purtech" <mikek(remove)@hlit.net> wrote in message
news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
> We have a low IT budget. I am using FTP to backup remote computers.
>
> Someone discovered my FTP service was opened and has been hitting me with
> 10's of thousands break-in attempts. Usually trying the administrator
> user.
>
> They will probably not figure out the user name, because I have changed
> the admin username, but it is almost everyday.
>
> Yesterday they tried the username of "Julian" Go figure. The police here
> won't do anything. Neither will my ISP.
>
> Any ideas?
>
> Thanks!
>

Roger
Tue May 16 20:19:38 CDT 2006

You have not indicated OS versions.
If SBS is W2k based then use IPsec in a filtering mode, else if
this is SBS based on W2k3 use either IPsec in a filtering mode
or use the W2k3 firewall or use boh
in either event with the objective of allowing the FTP ports only
for the IPs of the machines that do need FTP access for the
(internal I assume) backup purposes.
Now, the above can be used whether the SBS server is a one
nic or two nic server. However, if it is a one nic server you
should consider making it into a two nic server with all of your
infrastructure off the new internal nic and with the (ISA if you
SBS version permits) protected external nic allowing only what
is absolutely necessary (ex. DNS, time service, SMTP/Pop,
http/https, vpn). Ideally you would have the external nic also
behind at least an inexpensive firewall/router.


"Purtech" <mikek(remove)@hlit.net> wrote in message
news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
> We have a low IT budget. I am using FTP to backup remote computers.
>
> Someone discovered my FTP service was opened and has been hitting me with
> 10's of thousands break-in attempts. Usually trying the administrator
> user.
>
> They will probably not figure out the user name, because I have changed
> the admin username, but it is almost everyday.
>
> Yesterday they tried the username of "Julian" Go figure. The police here
> won't do anything. Neither will my ISP.
>
> Any ideas?
>
> Thanks!
>

Purtech
Wed May 17 11:28:42 CDT 2006

Roger:

It is SBS 2003 Premium.

These machines are external - without static addresses for the most part.

My server is dual NIC but I use it for Load Balancing. The entire main
office is protected by a hardware firewall.

I will consider your suggestion about the NICs.

Question: is having static addresses one of the best/least complicated ways
to solve this? I ask becuase I might take your answer to my boss to get the
money approved for it.

Mike


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:uNmI8$UeGHA.3484@TK2MSFTNGP04.phx.gbl...
> You have not indicated OS versions.
> If SBS is W2k based then use IPsec in a filtering mode, else if
> this is SBS based on W2k3 use either IPsec in a filtering mode
> or use the W2k3 firewall or use boh
> in either event with the objective of allowing the FTP ports only
> for the IPs of the machines that do need FTP access for the
> (internal I assume) backup purposes.
> Now, the above can be used whether the SBS server is a one
> nic or two nic server. However, if it is a one nic server you
> should consider making it into a two nic server with all of your
> infrastructure off the new internal nic and with the (ISA if you
> SBS version permits) protected external nic allowing only what
> is absolutely necessary (ex. DNS, time service, SMTP/Pop,
> http/https, vpn). Ideally you would have the external nic also
> behind at least an inexpensive firewall/router.
>
>
> "Purtech" <mikek(remove)@hlit.net> wrote in message
> news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
>> We have a low IT budget. I am using FTP to backup remote computers.
>>
>> Someone discovered my FTP service was opened and has been hitting me with
>> 10's of thousands break-in attempts. Usually trying the administrator
>> user.
>>
>> They will probably not figure out the user name, because I have changed
>> the admin username, but it is almost everyday.
>>
>> Yesterday they tried the username of "Julian" Go figure. The police here
>> won't do anything. Neither will my ISP.
>>
>> Any ideas?
>>
>> Thanks!
>>
>
>

Roger
Thu May 18 00:08:11 CDT 2006

I do not think static is important for this specific purpose as long as
you can distinguish by IP or subnet the machines that should be
allowed to access FTP. That would be sufficient to define a filter
in an IPsec policy to limit FTP access.
If you are entirely protected by firewall from outside, then either
the FTP is being hammered by an inside machine or the firewall
configuration needs reevaluation.
If you have SBS03 Premium, then are you using ISA ? This
could form a second layer after the hardware firewall, and the
ISA could be using authentication based on your Windows
accounts to gate access whereas the firewall would narrow
down what comes at you edge machines.

"Purtech" <mikek(remove)@hlit.net> wrote in message
news:uFfg47ceGHA.3952@TK2MSFTNGP04.phx.gbl...
> Roger:
>
> It is SBS 2003 Premium.
>
> These machines are external - without static addresses for the most part.
>
> My server is dual NIC but I use it for Load Balancing. The entire main
> office is protected by a hardware firewall.
>
> I will consider your suggestion about the NICs.
>
> Question: is having static addresses one of the best/least complicated
> ways to solve this? I ask becuase I might take your answer to my boss to
> get the money approved for it.
>
> Mike
>
>
> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
> news:uNmI8$UeGHA.3484@TK2MSFTNGP04.phx.gbl...
>> You have not indicated OS versions.
>> If SBS is W2k based then use IPsec in a filtering mode, else if
>> this is SBS based on W2k3 use either IPsec in a filtering mode
>> or use the W2k3 firewall or use boh
>> in either event with the objective of allowing the FTP ports only
>> for the IPs of the machines that do need FTP access for the
>> (internal I assume) backup purposes.
>> Now, the above can be used whether the SBS server is a one
>> nic or two nic server. However, if it is a one nic server you
>> should consider making it into a two nic server with all of your
>> infrastructure off the new internal nic and with the (ISA if you
>> SBS version permits) protected external nic allowing only what
>> is absolutely necessary (ex. DNS, time service, SMTP/Pop,
>> http/https, vpn). Ideally you would have the external nic also
>> behind at least an inexpensive firewall/router.
>>
>>
>> "Purtech" <mikek(remove)@hlit.net> wrote in message
>> news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
>>> We have a low IT budget. I am using FTP to backup remote computers.
>>>
>>> Someone discovered my FTP service was opened and has been hitting me
>>> with 10's of thousands break-in attempts. Usually trying the
>>> administrator user.
>>>
>>> They will probably not figure out the user name, because I have changed
>>> the admin username, but it is almost everyday.
>>>
>>> Yesterday they tried the username of "Julian" Go figure. The police here
>>> won't do anything. Neither will my ISP.
>>>
>>> Any ideas?
>>>
>>> Thanks!
>>>
>>
>>
>
>

Alun
Thu May 18 00:16:49 CDT 2006

Purtech wrote:
> It is SBS 2003 Premium.
>
> These machines are external - without static addresses for the most
> part.
> My server is dual NIC but I use it for Load Balancing. The entire main
> office is protected by a hardware firewall.
>
> I will consider your suggestion about the NICs.
>
> Question: is having static addresses one of the best/least
> complicated ways to solve this? I ask becuase I might take your
> answer to my boss to get the money approved for it.

Static IP addresses will do nothing to solve this issue. If anything,
they'll make it easier for people to return to your server a month from now
and try again.

First, the important question - is there a significant impact to your system
from these logon attempts?

Every system on the Internet gets people knocking on the door from time to
time, and sometimes the knocking can be persistent. You have a server -
they get knocked on more than most, because you can't just put up a firewall
in the way - you're trying to have your server available for your users.

If your user accounts have strong passwords, the hackers can not get in by
just guessing.

I'd be tempted to put up a banner message implying that visitors to your FTP
site implicitly give you permission to connect back to them and install
remote control software, just to see if they get scared enough to go away -
it's unlikely that'll help, because these are just stupid scripts banging on
your server's door.

You could also substitute a third-party FTP server, with FTPS and
client-certificate support, so that it will not accept connections from
random users, but that may be more effort than you are willing to support.

A VPN solution might help, but there's also the possibility that you may be
comfortable enough just leaving things the way they are, and using this as a
teaching exercise for your employer, to teach him that there are important
reasons why you insist on strong passwords!

Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
23921 57th Ave SE | alun@wftpd.com.
Washington WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.

Purtech
Thu May 18 15:49:52 CDT 2006

Alun:

I was talking about static addresses for the clients. The FTP has always had
a static address. In FTP there is a place were you allow certain addresses
and deny all others.

That is what I was thinking about.

Thanks very much for you input.

Mike

"Alun Jones" <alun@texis.invalid> wrote in message
news:cfadnZIuhoTfnvHZnZ2dneKdnZydnZ2d@comcast.com...
> Purtech wrote:
>> It is SBS 2003 Premium.
>>
>> These machines are external - without static addresses for the most
>> part.
>> My server is dual NIC but I use it for Load Balancing. The entire main
>> office is protected by a hardware firewall.
>>
>> I will consider your suggestion about the NICs.
>>
>> Question: is having static addresses one of the best/least
>> complicated ways to solve this? I ask becuase I might take your
>> answer to my boss to get the money approved for it.
>
> Static IP addresses will do nothing to solve this issue. If anything,
> they'll make it easier for people to return to your server a month from
> now and try again.
>
> First, the important question - is there a significant impact to your
> system from these logon attempts?
>
> Every system on the Internet gets people knocking on the door from time to
> time, and sometimes the knocking can be persistent. You have a server -
> they get knocked on more than most, because you can't just put up a
> firewall in the way - you're trying to have your server available for your
> users.
>
> If your user accounts have strong passwords, the hackers can not get in by
> just guessing.
>
> I'd be tempted to put up a banner message implying that visitors to your
> FTP site implicitly give you permission to connect back to them and
> install remote control software, just to see if they get scared enough to
> go away - it's unlikely that'll help, because these are just stupid
> scripts banging on your server's door.
>
> You could also substitute a third-party FTP server, with FTPS and
> client-certificate support, so that it will not accept connections from
> random users, but that may be more effort than you are willing to support.
>
> A VPN solution might help, but there's also the possibility that you may
> be comfortable enough just leaving things the way they are, and using this
> as a teaching exercise for your employer, to teach him that there are
> important reasons why you insist on strong passwords!
>
> Alun.
> ~~~~
> [Please don't email posters, if a Usenet response is appropriate.]
> --
> Texas Imperial Software | Find us at http://www.wftpd.com or email
> 23921 57th Ave SE | alun@wftpd.com.
> Washington WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
> Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.
>
>

Purtech
Thu May 18 15:58:41 CDT 2006

Roger:

I am not using ISA. We have SBS Premium 2003. I didn't know I could use it
for FTP purposes.

So that would add an additional layer, uh?

The FTP client is now authenticating to the server. Would this require
another password - in effect? Really think that is necessary?

RECAP: I am not using the 2003 firewall, like I said, just the hardware
router firewall. Then making the FTP client authenticate to the domain. I
also removed all permissions on the FTP folders except admin and the FTP
client account.

(NOW they are trying names to break-in: tom, sam etc. Oh brother!)

Mike


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:%23R5mWkjeGHA.5016@TK2MSFTNGP04.phx.gbl...
>I do not think static is important for this specific purpose as long as
> you can distinguish by IP or subnet the machines that should be
> allowed to access FTP. That would be sufficient to define a filter
> in an IPsec policy to limit FTP access.
> If you are entirely protected by firewall from outside, then either
> the FTP is being hammered by an inside machine or the firewall
> configuration needs reevaluation.
> If you have SBS03 Premium, then are you using ISA ? This
> could form a second layer after the hardware firewall, and the
> ISA could be using authentication based on your Windows
> accounts to gate access whereas the firewall would narrow
> down what comes at you edge machines.
>
> "Purtech" <mikek(remove)@hlit.net> wrote in message
> news:uFfg47ceGHA.3952@TK2MSFTNGP04.phx.gbl...
>> Roger:
>>
>> It is SBS 2003 Premium.
>>
>> These machines are external - without static addresses for the most part.
>>
>> My server is dual NIC but I use it for Load Balancing. The entire main
>> office is protected by a hardware firewall.
>>
>> I will consider your suggestion about the NICs.
>>
>> Question: is having static addresses one of the best/least complicated
>> ways to solve this? I ask becuase I might take your answer to my boss to
>> get the money approved for it.
>>
>> Mike
>>
>>
>> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
>> news:uNmI8$UeGHA.3484@TK2MSFTNGP04.phx.gbl...
>>> You have not indicated OS versions.
>>> If SBS is W2k based then use IPsec in a filtering mode, else if
>>> this is SBS based on W2k3 use either IPsec in a filtering mode
>>> or use the W2k3 firewall or use boh
>>> in either event with the objective of allowing the FTP ports only
>>> for the IPs of the machines that do need FTP access for the
>>> (internal I assume) backup purposes.
>>> Now, the above can be used whether the SBS server is a one
>>> nic or two nic server. However, if it is a one nic server you
>>> should consider making it into a two nic server with all of your
>>> infrastructure off the new internal nic and with the (ISA if you
>>> SBS version permits) protected external nic allowing only what
>>> is absolutely necessary (ex. DNS, time service, SMTP/Pop,
>>> http/https, vpn). Ideally you would have the external nic also
>>> behind at least an inexpensive firewall/router.
>>>
>>>
>>> "Purtech" <mikek(remove)@hlit.net> wrote in message
>>> news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
>>>> We have a low IT budget. I am using FTP to backup remote computers.
>>>>
>>>> Someone discovered my FTP service was opened and has been hitting me
>>>> with 10's of thousands break-in attempts. Usually trying the
>>>> administrator user.
>>>>
>>>> They will probably not figure out the user name, because I have changed
>>>> the admin username, but it is almost everyday.
>>>>
>>>> Yesterday they tried the username of "Julian" Go figure. The police
>>>> here won't do anything. Neither will my ISP.
>>>>
>>>> Any ideas?
>>>>
>>>> Thanks!
>>>>
>>>
>>>
>>
>>
>
>

Roger
Thu May 18 20:39:23 CDT 2006

OK, going back to your original post you said you have FTP in order
to effect a type of backup. From this I inferred that FTP only needs
to be accessible by your internal machines, and could be fully shielded
from the internet without breaking your support need.
In that case the firewall should block all FTP with the world.
Then, if you are still hammered it is of course originating from an
inside machine - which means a compromised machine if the names
attempted are garbage, or which means a compromised machine or
a pre-disciplined staff member if the names are reasonable.
Now, by layers, I was again thinking in terms of with what machines
FTP should be allowed, and that use of either Windows firewall or
IPsec on the server could be used to control access at the host (i.e.
a second time, the first being your firewall).
You can make it so that only desired machine can even try to log
in with the FTP service. If after that has been done you still have
the problem you know that it must be coming from one of those
machines (that likely would need cleaning, and discovery of what
allowed it to become that way).
I only mentioned ISA as I thought it was one of the parts that made
Premium Premium, and it can be used to much restrict at the SBS
server what machines on the inside nic's network can do when
crossing the SBS through its outward nic to the world (other designs
also exist), and not just control but also log.
"Purtech" <mikek(remove)@hlit.net> wrote in message
news:%23h46Z3reGHA.3488@TK2MSFTNGP02.phx.gbl...
> Roger:
>
> I am not using ISA. We have SBS Premium 2003. I didn't know I could use it
> for FTP purposes.
>
> So that would add an additional layer, uh?
>
> The FTP client is now authenticating to the server. Would this require
> another password - in effect? Really think that is necessary?
>
> RECAP: I am not using the 2003 firewall, like I said, just the hardware
> router firewall. Then making the FTP client authenticate to the domain. I
> also removed all permissions on the FTP folders except admin and the FTP
> client account.
>
> (NOW they are trying names to break-in: tom, sam etc. Oh brother!)
>
> Mike
>
>
> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
> news:%23R5mWkjeGHA.5016@TK2MSFTNGP04.phx.gbl...
>>I do not think static is important for this specific purpose as long as
>> you can distinguish by IP or subnet the machines that should be
>> allowed to access FTP. That would be sufficient to define a filter
>> in an IPsec policy to limit FTP access.
>> If you are entirely protected by firewall from outside, then either
>> the FTP is being hammered by an inside machine or the firewall
>> configuration needs reevaluation.
>> If you have SBS03 Premium, then are you using ISA ? This
>> could form a second layer after the hardware firewall, and the
>> ISA could be using authentication based on your Windows
>> accounts to gate access whereas the firewall would narrow
>> down what comes at you edge machines.
>>
>> "Purtech" <mikek(remove)@hlit.net> wrote in message
>> news:uFfg47ceGHA.3952@TK2MSFTNGP04.phx.gbl...
>>> Roger:
>>>
>>> It is SBS 2003 Premium.
>>>
>>> These machines are external - without static addresses for the most
>>> part.
>>>
>>> My server is dual NIC but I use it for Load Balancing. The entire main
>>> office is protected by a hardware firewall.
>>>
>>> I will consider your suggestion about the NICs.
>>>
>>> Question: is having static addresses one of the best/least complicated
>>> ways to solve this? I ask becuase I might take your answer to my boss to
>>> get the money approved for it.
>>>
>>> Mike
>>>
>>>
>>> "Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
>>> news:uNmI8$UeGHA.3484@TK2MSFTNGP04.phx.gbl...
>>>> You have not indicated OS versions.
>>>> If SBS is W2k based then use IPsec in a filtering mode, else if
>>>> this is SBS based on W2k3 use either IPsec in a filtering mode
>>>> or use the W2k3 firewall or use boh
>>>> in either event with the objective of allowing the FTP ports only
>>>> for the IPs of the machines that do need FTP access for the
>>>> (internal I assume) backup purposes.
>>>> Now, the above can be used whether the SBS server is a one
>>>> nic or two nic server. However, if it is a one nic server you
>>>> should consider making it into a two nic server with all of your
>>>> infrastructure off the new internal nic and with the (ISA if you
>>>> SBS version permits) protected external nic allowing only what
>>>> is absolutely necessary (ex. DNS, time service, SMTP/Pop,
>>>> http/https, vpn). Ideally you would have the external nic also
>>>> behind at least an inexpensive firewall/router.
>>>>
>>>>
>>>> "Purtech" <mikek(remove)@hlit.net> wrote in message
>>>> news:uf4YvUQeGHA.3388@TK2MSFTNGP05.phx.gbl...
>>>>> We have a low IT budget. I am using FTP to backup remote computers.
>>>>>
>>>>> Someone discovered my FTP service was opened and has been hitting me
>>>>> with 10's of thousands break-in attempts. Usually trying the
>>>>> administrator user.
>>>>>
>>>>> They will probably not figure out the user name, because I have
>>>>> changed the admin username, but it is almost everyday.
>>>>>
>>>>> Yesterday they tried the username of "Julian" Go figure. The police
>>>>> here won't do anything. Neither will my ISP.
>>>>>
>>>>> Any ideas?
>>>>>
>>>>> Thanks!
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>

Roger
Thu May 18 20:40:52 CDT 2006

It really does not matter so long as you can name as subnet (static or
dynamic) that contains the clients and only the clients.

"Purtech" <mikek(remove)@hlit.net> wrote in message
news:%23Jk1fyreGHA.3484@TK2MSFTNGP04.phx.gbl...
> Alun:
>
> I was talking about static addresses for the clients. The FTP has always
> had a static address. In FTP there is a place were you allow certain
> addresses and deny all others.
>
> That is what I was thinking about.
>
> Thanks very much for you input.
>
> Mike
>
> "Alun Jones" <alun@texis.invalid> wrote in message
> news:cfadnZIuhoTfnvHZnZ2dneKdnZydnZ2d@comcast.com...
>> Purtech wrote:
>>> It is SBS 2003 Premium.
>>>
>>> These machines are external - without static addresses for the most
>>> part.
>>> My server is dual NIC but I use it for Load Balancing. The entire main
>>> office is protected by a hardware firewall.
>>>
>>> I will consider your suggestion about the NICs.
>>>
>>> Question: is having static addresses one of the best/least
>>> complicated ways to solve this? I ask becuase I might take your
>>> answer to my boss to get the money approved for it.
>>
>> Static IP addresses will do nothing to solve this issue. If anything,
>> they'll make it easier for people to return to your server a month from
>> now and try again.
>>
>> First, the important question - is there a significant impact to your
>> system from these logon attempts?
>>
>> Every system on the Internet gets people knocking on the door from time
>> to time, and sometimes the knocking can be persistent. You have a
>> server - they get knocked on more than most, because you can't just put
>> up a firewall in the way - you're trying to have your server available
>> for your users.
>>
>> If your user accounts have strong passwords, the hackers can not get in
>> by just guessing.
>>
>> I'd be tempted to put up a banner message implying that visitors to your
>> FTP site implicitly give you permission to connect back to them and
>> install remote control software, just to see if they get scared enough to
>> go away - it's unlikely that'll help, because these are just stupid
>> scripts banging on your server's door.
>>
>> You could also substitute a third-party FTP server, with FTPS and
>> client-certificate support, so that it will not accept connections from
>> random users, but that may be more effort than you are willing to
>> support.
>>
>> A VPN solution might help, but there's also the possibility that you may
>> be comfortable enough just leaving things the way they are, and using
>> this as a teaching exercise for your employer, to teach him that there
>> are important reasons why you insist on strong passwords!
>>
>> Alun.
>> ~~~~
>> [Please don't email posters, if a Usenet response is appropriate.]
>> --
>> Texas Imperial Software | Find us at http://www.wftpd.com or email
>> 23921 57th Ave SE | alun@wftpd.com.
>> Washington WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
>> Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.
>>
>>
>
>