|
Posted by Chris M on October 31, 2007, 11:08 am
Please log in for more thread options Mike Thompson wrote:
> Yes, it's not an IIS attack. Would the firewall in Windows Server 2003 SP2
> be adequate?
Yes, that would be enough to prevent the logon attempts from occuring -
you'd just need to open the relevant ports for IIS to remain visible to
the outside world.
Ideally you'd have the firewall at your network perimeter rather than on
the server itself, but that really depends on how your network is
configured.
--
Chris.
>> Mike Thompson wrote:
>>> I have been running a public web server for 10 years, now running Windows
>>> 2003 Server, and I've just encountered (for the first time) an ISP who
>>> cannot or will not stop hack attacks coming from one IP address in his
>>> center. The hacker tries to log on as Administrator, and his activity is
>>> logged in the Security Log. This has happened repeatedly over the last
>>> several months, and I've talked to the ISP by phone numerous times, but
>>> no action.
>>>
>>> Is there a way to block a single IP address from logging on to Windows
>>> 2003 Server (SP1)? This is not an IIS issue, it's a Windows Server
>>> issue, as the attacker is not trying to log onto the website, he is
>>> trying to log on to the server as Administrator.
>> How is the attacker actually trying to log on to the server? Not Remote
>> Desktop surely?
>>
>> If the logon failures are not coming from IIS (via integrated
>> authentication) then you have a deeper problem - your server isn't
>> correctly firewalled. These logon attempts from an untrusted IP address
>> should never even reach your server in the first place.
>>
>> --
>> Chris.
>
>
| 
XML Sitemap