anonymous user

Message

nic · #1 Post by **nic** » 2006-08-10 21:14

I just set up my ftp server. and already on the second day, there are unwelcome guests! i banned the ip...

my question: They always tried to connect as Administrator. I didn't set up a user Administrator. Is this user automatically setup by the server, and if yes, where can I adminstrate this account?

thanks so much for some help...

nic

Nusz · #2 Post by **Nusz** » 2006-08-11 14:38

Nic. I think they're trying to brute force into the box expecting it to be an IIS box. I've had the same thing happen.
One guy continuously used Administrator for the user and the other used Oracle.

Since I don't have either of those user names set up I wasn't afraid for my data security but blocked the IP's anyways because I just don't want to deal with the extra activity and the extra logging. in 6 days I had 376 pages (in MS Word on Arial 10) in my log.

As far as the username Administrator being activated automatically I can't say for certain but if it is, the password in place on my system seemed to be keeping them out pretty well.

#3 Post by **boco** » 2006-08-11 18:09

FZServer does *NOT* set up accounts automatically. These intrusions are no actual logins, just login attempts. They try to connect to unpatched IIS servers.

GHBoom has an interesting solution for this problem, you should read here.

boco