5

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen over a 15 minute span. So it's obvious this is not someone who just forgot their password.

I know there are a lot of bots out there pinging servers and taking shots at firewalls. My question is if there is any yard stick to measure how bad the problem is? What is normal for a Windows Server running behind a firewall?

2 Answers 2

5

I suppose I will answer what I have learned in the 6 or so months since I posted this question.

I monitored a Windows Server, connected to a static IP address, with basic security in place (firewall, shut down unnecessary windows services, etc). I found that if I left FTP, using IIS 6 running, I would get 30,000 to 60,000 random login attempts a month. Some months were worse than others, bulk login attempts came in every shape and size. They tried lots of login names, sometimes tried the same name a lot.

When I stopped the FTP service the login attempts stopped.

We also implemented a solid procedure for backing up the Event Log so that large login attempts can't be used to cover up other activity by clogging the Event Log.

I'll accept other answers if anyone else has any experience with this. Otherwise I'll leave this answer for anyone interested.

1
1

Yes, this is normal. I have some clients that have 'bastion' hosts on the internet. The primary reason for this (not for me, but my clients) is they have the one VPS or VM, and need to for whatever reason run every single service on that one server. Example: some of my clients have WordPress installations on their VM so they need port 22 for ssh, port 80 for their web, port 443 for secure web, and mail ports 25 and 587 (I'm nice, I don't restrict their ability to administrate but I DO butt in and 'manage' their mail subsystem if it becomes a problem). I even have some clients that expose mysql port 3306; they tell me they HAVE to have it for replication and backups, but luckily this is rarer.

Point being related to OP in this manner. Yes, if you have an exposed service on the internet it's going to be attacked incessantly not only by the script kiddies, but there are even some commercial agencies that do this claiming it's 'essential' to log ports for internet wide security, which is dubious at best.

Best solution, imo, is private non-routable network addresses and VPN's for administration, and poke holes in the firewall for two ports, 80 and 443, and forward the connections to the firewall exposing only those ports on the public address. But I can't make my clients do this.

The biggest culprits out there, in my experience, come from China and Pakistan. Certain portions of netblock 221.x.x.x and 222.x.x.x with /13 or /14 subnet are the biggest offenders. Those run 24x7x365xevery_single_second. I have those subnets permanently firewalled and those alone knock out 20% of the 'bad' traffic. You unfortunately can't block every single 'bad' connection that hits your firewall because eventually you'll have the whole internet blocked.

The firewall takes care of most known or algorithmic attacks, and diligent administration keeps the sites safe. I've been administrating internet facing hosts for some time and only once have I had a server compromised, and that oddly enough was a Sun Microsystems Solaris box, which had an unpatched RPC/X Windows based exploit, but that was over 20 years ago.

Merry Christmas all

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .