0

I need some help.

I am seeing a lot of attempted logins in my Security Log.

This is a fairly new Godaddy VPS Server running Windows 2008 R2.

The attends are with various user IDs, that do repeat.

The log entry looks like this:

Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 8/23/2019 5:43:31 PM Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: s132-148-82-95.secureserver.net Description: An account failed to log on.

Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed: Security ID: NULL SID Account Name: Administrator Account Domain:

Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a

Process Information: Caller Process ID: 0x0 Caller Process Name: -

Network Information: Workstation Name: MSTSC Source Network Address: - Source Port: -

Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

As you can see it doesn't give a caiier IP address.

And Microsoft says NTLM is not tied to any port.

I have tried blocking ports on TCP 1-79, 81-3388, 3390-20000, and in UDP 1-20000 in the firewall. But that doesn't stop the attempts.

I RDP into the server and it's only allowed from my IP address in the firewall.

Help.

I don't know what to try next.

Should I ever try to block them or should I just ignore them?

Gary

  • 2
    Servers facing the Internet tends to get login attempts. Bigger problem here is that the support for 2008 R2 will end in January 2020. It's time to upgrade. – Esa Jokinen Aug 24 at 3:33
  • Logon Type 3 is a network logon BUT it is not a remote interactive logon, which means that these are not logon attempts via RDP. Do you have IIS installed on this server? Do you have any other web platform installed? What are you using this server for and what are you exposing it to the internet for? HTTP, SMTP, FTP, etc.? See these articles for more info. - ultimatewindowssecurity.com/securitylog/encyclopedia/… - ultimatewindowssecurity.com/securitylog/book/… – joeqwerty Aug 24 at 5:05
  • Yes IIS is installed. And no other web service. I have tried blocking port 80 but that didn't change much. – gwardell Aug 24 at 6:33
0

Are you 100% sure RDP is being restricted by IP at the firewall? My first impression would be that login attempts are being made to your server via RDP. You really need to check which ports are open and publicly accessible.

One way to do this is to launch a web browser on the server, go to GRC.com, click the Services menu and choose ShieldsUp!. At the next page, click the Proceed button. On the page that opens, find the ShieldsUp Services box where you can scan your server’s ports. Definitely use the Common Ports and All Service Ports buttons. Additionally enter 3389 into the input box and click User Specified Custom Port Probe. This will check to see if RDP is open and publicly accessible.

I would also recommend that on the firewall you block all incoming connections to all ports and then selectively open ports to your requirements. Make sure you don’t block yourself out of your own server when you do this!

Hopefully following these steps will end the unauthorised login attempts. Good luck!

  • I'll try grc. I have tried with port 3389 as the only port open and that didn't help. And port 3389 is restricted in the firewall to only my ip address. And I know this works as someone was trying to rdp in to help me and they couldn't. – gwardell Aug 24 at 6:41
  • I performed a port scan of your server (assuming IP address 132.148.82.95) and you have ports 80,2383,3306,3389 open). A scan from a public IP, should only reveal 80. 3306 is MySQL and generally should not be publicly accessible. Any security vulnerabilities in MySQL which you haven’t patched could mean an attacker could get into MySQL. You also have RDP (3389) open which should be closed if your IP is the only one whitelisted. – Chris Driver Aug 24 at 13:57
  • 9876 is also open – Chris Driver Aug 24 at 14:03
  • Yes, that is the up. In don't understand why you see 3389 open as that is restricted to my ip. The other ports seem to indicate that Windows firewall isn't working the way I thought. – gwardell Aug 24 at 19:17
  • I have a rule in the Firewall: Enabled=Yes; Action=Block; Ports=1-79, 81-3388, 3390-20000. I don't understand why this isn't blocking those ports. – gwardell Aug 24 at 20:41
0

Use wail2ban. It's like fail2ban but for windows https://github.com/glasnt/wail2ban here is the link for the project. But it seems like the development has stopped for it. If I find any better alternatives to fail2ban, I will update my answer. In the meantime, definitely try wail2ban. It will temporarily block IP Addresses of failed login attempts after 5 failed attempts for 10 mins (the conditions, bantime etc can be changed). Don't forget to whitelist your own IP because by mistake if you enter your password wrong 5 times, you will get yourself banned for 10 mins (Default bantime set in wail2ban)

  • I'll check out wail2ban. Does it list the failed attempts do I can block them? – gwardell Aug 24 at 6:44
  • Yes you can and also you can add IPs to the block list manually – Rahul Biswas Aug 24 at 7:09
  • wail2ban seems to be archived and no longer usable. – gwardell Aug 25 at 18:41
  • try win2ban. I believe its same as wail2ban – Rahul Biswas Aug 26 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.