xXDarkenSoulXx

Ok. Someone's been trying to get into my ftp server by trying passwords with the user name "Administrator". Funny enough the ip is from china(i don't know if the person is using a proxy or not) and I never set a user called Administrator.
Here's part of the log from filezilla:
As you could see, the hacker was trying to get in from the 22 until I discovered him on the 28.

The only person that knows this address besides me is a friend, and I don't think hes the one behind this.

I have changed a few settings to prevent this in the future like

• Setting up a new user account
• Binding the admin interface to my server's internal ip
• Autoban IP address after 10 failed attempts

Is there anything else that I could do to beef up my security? Chinese hackers are kind of scary. I am using a homeserver.com address, by the way.

__________________

scottsee

Respectivly, thats a very tough question to answer for obvious reasions.

Check metasploit to see if your system is vulnerable to any know exploits, maybee install Untangle? If you're seriously intrested in locking your server(s) up, become a member over at http://www.ethicalhacker.net/ & http://forums.remote-exploit.org/ Download BT3 or BT4 and start pentesting your computers. You could also take some CEH courses If you like it enought... Tough to say without knowing what you have, and how it's configured..

You could always settup a fake box, with the admin enabled not connected to anything, let him gain access to it and see exactly what he's trying to do.. It would be entertaining..

__________________
ATX PSU design standerds (V2.2) recomend psu fans orentation is to draw intake air from the case as an exhaust.

DaClownie

This. It's evil and also informative.

scottsee

I doubt it's anything serious, if he's attempting to "get you" he's not doing a good job of beeing stealthy, you'll might want to enable your firewall to log half open awk/syn connections to see if he is silently trying to scan your computer for open ports.

You could always lock down all the ip ranges outside of your local area..

__________________
ATX PSU design standerds (V2.2) recomend psu fans orentation is to draw intake air from the case as an exhaust.

Marma Duke

I have someone trying to do the same thing, they try 24/7 every 6 minutes with the username administrator and a different password.

Howerver the username 'administrator' doesn't exist so he's not doing so well at it.

I just banned the IP anyhow, dunno why I never did before.

xXDarkenSoulXx

Thanks for the tips. Man. That's a lot to learn!

__________________

yawnbox

fyi

metasploit was sold.
http://jeromiejackson.com/index.php/...etasploit-Beta


check the faqs
http://www.metasploit.com/home/faq


looking forward to the developments.

__________________