SMTSVC ?

25 Mar 2005 9:45 PM

razornt

Someone is trying to hack our server via SMTPSVC. When I view the event log
(system) I see Event ID 100 SMTPSVC and a login attempt. However, when I try
to match the Event log time with the SMTPSVC log time nothing matches. I want
to block the IP Address of this potential intruder. How do I find the IP
Address of this potential intruder?

SMTPSVC extended property logs are turned on with client ip, date and time,
server ip and server port and also user name.

Default SMTP virtual server
No relay (only the list below) "There is no list"
Basic and Windows Security package are checked for Authentication

Thanks in advance.

26 Mar 2005 12:47 AM

Jeff Cochran

On Fri, 25 Mar 2005 13:45:05 -0800, "razornt"
<razo***@discussions.microsoft.com> wrote:

>Someone is trying to hack our server via SMTPSVC. When I view the event log
>(system) I see Event ID 100 SMTPSVC and a login attempt. However, when I try
>to match the Event log time with the SMTPSVC log time nothing matches.

Are you accounting for the offset from GMT? The SMTP logs are in GMT,
Event logs are usually in local time.

Jeff

Show quoteHide quote

> I want
>to block the IP Address of this potential intruder. How do I find the IP
>Address of this potential intruder?
>
>SMTPSVC extended property logs are turned on with client ip, date and time,
>server ip and server port and also user name.
>
>Default SMTP virtual server
>No relay (only the list below) "There is no list"
>Basic and Windows Security package are checked for Authentication
>
>Thanks in advance.

28 Mar 2005 2:35 PM

razornt

Thanks Jeff. That makes sense. I check into right away.

Show quoteHide quote

"Jeff Cochran" wrote:

> On Fri, 25 Mar 2005 13:45:05 -0800, "razornt"
> <razo***@discussions.microsoft.com> wrote:
>
> >Someone is trying to hack our server via SMTPSVC. When I view the event log
> >(system) I see Event ID 100 SMTPSVC and a login attempt. However, when I try
> >to match the Event log time with the SMTPSVC log time nothing matches.
>
> Are you accounting for the offset from GMT? The SMTP logs are in GMT,
> Event logs are usually in local time.
>
> Jeff
>
>
> > I want
> >to block the IP Address of this potential intruder. How do I find the IP
> >Address of this potential intruder?
> >
> >SMTPSVC extended property logs are turned on with client ip, date and time,
> >server ip and server port and also user name.
> >
> >Default SMTP virtual server
> >No relay (only the list below) "There is no list"
> >Basic and Windows Security package are checked for Authentication
> >
> >Thanks in advance.
>
>

28 Mar 2005 9:05 PM

Leon Mayne [MVP]

razornt wrote:

> Someone is trying to hack our server via SMTPSVC. When I view the
> event log (system) I see Event ID 100 SMTPSVC and a login attempt.
> However, when I try to match the Event log time with the SMTPSVC log
> time nothing matches. I want to block the IP Address of this
> potential intruder. How do I find the IP Address of this potential
> intruder?

As long as your permissions are set up OK you don't really have to worry.
Spammers are usually scanning for open relays and relays with simple
authentication (e.g. username 'user', password 'password') to send spam
through. If they don't succeed quickly they'll just try another server. SMTP
logs on any platform are always full of hack attempts.