How to trace a proxy..

I have someone that keeps trying to use a (I guess) password generator on my companies' FTP server.. He tries to log in via administrator and it seems to be trying a different password every 1-2 minute intervals... Of course it traces back to somewhere in China, so is there a way while he is trying to connect that I can trace it back to his true IP? He is actually trying as I type this.. I can of course keep blocking his IP or range and I truly need to limit the login attempts to 3-5 tries.. This is a newly set up FTP server and still working out the kinks... This might also be a different topic but I would also like to make this FTP server to appear to be invisible to the outside world, I currently have my router set to block ping requests but doesn't seem to do much good since you can go into nmap and do a -sS -v -P0 scan and find that FTP is open, how can I make it to where an nmap or any other scan will not reveal that port to be open... Mainly right now I want to track this certain IP so I can call the sys admin and let him know that this person is unlawfully trying to access my server... Thanks in advance..

With the resources available to you, chances are you are never going to be able to track the IP. You can just block it all together - Probably not a bad idea since it belongs to a Proxy!

Dont know your set up but look in to deploying a firewall if you can, either software or hardware to filter traffic out.

Set it to drop the connection after 3 incorrect tries (or 5 depending on what you want)

//Are you sure it is a proxy? It may be that this guy is actually in China? If he is bothering to run a password cracker against your FTP server, chances are he may not be too bright!

Well,

I think that Nokia is pretty much spot on.

Quote:

---

so is there a way while he is trying to connect that I can trace it back to his true IP?

---

Not really, that is how proxy servers work, you will just see them. I strongly suspect that this will be a bot and is using a machine that is owned rather than an intentional proxy server..................do you know anything that makes you think that it is a genuine proxy?

Your only hope would be to contact the owner of the proxy as you would need to match to their logs for them to find out the connecting IP, which could in itself be a proxy.

I think that your two main problems are going to be the language barrier and the fact that most people are not keen to admit that they have been taken advantage of.

I am not sure if this is feasible but you might look at changing the administrator account name from the default, as that might cause the botware to give up and go somewhere else. I would still block the IP range etc. as Nokia suggested.

:)

I really appreciate your replies... The only reason I am thinking it's a genuine proxy is because I have since blocked 5 of his proxys ranging anywhere from the netherlands, U.S., to the latest being China... Once I kick him, then block him out he would come back in 10 minutes later under a different proxy... Now, I am using filezilla for an FTP server and I don't see an option to set it to not allow more than 3 login attempts... I only have the FTP accessible for 3 different user accounts because the FTP is used for 3 of my businesses under the same roof and on the same LAN.... This FTP is still in the preliminary stages so I am in still working out all the kinks... That all being said, what firewall would you all suggest, and maybe a different (more secure) FTP server, and lastly is it the firewall that you set to not allow a certain amount of login attempts?

Administrative login to the FileZilla server can be limited to a specific port. I think the default is something like 14171 or something. You can set the firewall to block that port from outside your network. That may help.

You should be able to set the login attempts on the FTP server, or the local server for the specific accounts. The firewall will help you block ports and source IPs.

Depending on what you have available for a host system, check out ZoneAlarm, or Kerio. The have personal as well as heavier duty small network firewalls, and these can help you better shape the internal network traffic.

Hmmmm,

They could still all be members of a "bot army" of owned machines.

I honestly don't know the details of this sort of stuff, but I do know that if he gets a "this account does not exist" type of message he will go away, as that tells him he now has to guess the user ID and the password.

Quote:

---

I only have the FTP accessible for 3 different user accounts because the FTP is used for 3 of my businesses under the same roof and on the same LAN

---

That give me another idea. A few years ago (Win NT 4.0) I saw some software that restricted login to certain servers/applications from specific machines on the LAN.

Sorry I don't have any details and have lost my contacts where it was in use, but it might be worth checking out.

:)

I was using this ftp server called fastream. Its freeware for one version of it. If you're only allowing 3 users... it should be fine for you.

http://www.fastream.com/netfileserver.htm

You call the usernames whatever you want. Give each user a separate home directory and set permission on what they can do. You can restrict/allow on an ip/basis. You can even restrict via country... so you can only allow connections from IPs in the US and Canada, etc.

Check it out. There are some limitations with the free version... such as number of user accounts. No quota or speed limitations though... :( The version I had was the "pro" version before they released two versions. The quota and speed limitations were quite nice.

I only used it so people could upload a couple of files to me. I wasn't really hosting much. It was just something that was very quick and easy to setup. I only used it for about 6 months or so.

Well if it is only needed on the local network.......dont accept remote connections. There is no reason for anyone to be able to log on to it via the internet if it is only needed locally.

Could you discribe your set-up?

I will describe my setup, sorry I should have before.. What I have is the following:
I have a 14 computer LAN, 2 4-port routers and 3 switches that are linked together with many fiery/scanner/plotters/copiers running... I have 2 dsl connections (one on each router).. One router has dhcp server enabled and one the dhcp server is disabled... I have a dedicated box set up for just the FTP server... All I have running on the FTP server is windows 2000, an anti-virus program and Filezilla.. I pretty much have Filezilla set up as default.. I have dsl dynamic IP service so I have 3 noip.com accounts (1 each for 3 companies) to resolve the IP from dynamic to static to the FTP server.. Set up on the FTP box I have 3 accounts set up (one for each business) and each one has a folder for each business, and inside those folders the customers can read, write, append, delete files or folders for their use... The 3 different folders each have a user name and password which are probably easily guessable since they are the name of the company... I made it that way so it would be easier on my customers... Any of the other computers on the LAN can access the FTP folders on the FTP box by typing a username and password upon getting into them... (ie. administrator = user and password).. I have norton firewall on a few of the main computers that get email but have truly never had much of a need for firewalls on the others... The only problems I have ever ran into were the people trying to get into this FTP... So I guess I am wondering how I can make my router (the one the FTP is running off of) not appear to be running an FTP server to the outside world, it is a dlink 4-port.. and how to overall secure the whole network down...

Going off your setup your FTP server should be unaccessable to the 'outside' world.

The should not be able to scan past your router and certainly should not be able to connect to it and run a password cracker against you!

Read my PM then get back to me buddy.

Until then - a quick solution would be to implement and ACL on your routers blocking traffic to port 20 & 21 try one that allows your internal ips only - which will by default block any IP not in that range.

LOL!!!! I have been using Deny Hosts or other
Port Monitor Programs on my servers.....
I have a S&^%house full of block IP addresses
3 strikes and your OUT!!!

I have given up complaining to overseas ISP's.....
Your P*&&*ing in the wind....


Snort also does a nice job as well....

Well, in am attempt to make my setup a little more clear I have slapped together a jpeg'd autocad drawing to look at.. The address to grab it is as follows:

http://photos.yahoo.com/[email protected]

I dont know if it is just me or the way I am viewing it but it is really hard to see it. Zooming in just makes it too blury to read.

Can you use a different app to draw it?

Did you happen to download it and view it offline? If need be I can up the dpi and/or scale up the text... Let me know... Thanks..

Yeah I saved it and tried zoooooming in but to no avail! :D

Alright... I have posted the .pdf file on a free file server.. Maybe that will help.. thank you..
http://www.filespoint.com/point/8059...OLOGY.pdf.html

OK, well your router is obviously showing the FTP server to the outside world - and letting people attempt to connect to it. As you have said that it only needs to be accessed locally, I would do one or all of the following:

Depending on the type of router you have look into deploying an ACL that will permit only traffic from 192.168.1.0/24 to any thing destined for your FTP server Which will be default block any IP address not in your network. So your router will not let any 'internet' traffic destined for your ftp server through.

You could move your FTP server off your router and put it on to switch 2. as this is the switch that connects the 2 buidings together so to speak - depending on the speed/bandwidth you have available to you of course.

You have 5 switches supporting 19 hosts (the routers just have a 4 port switch in them)...for me this is a tad exsessive and is just adding to network latency - if your switches are running in a 'store and forward' switching mode you could be slowing your network down considerably. You could even come down to just your 24 port switch if distance is not a factor!

My personal preference would be to connect all hosts up to either of the switches - not the routers - which is still basically acting as a switch I know but there is no need to have hosts connected to it. DHCP will still work through the switches - all though with just 19 hosts you could have static IPs or peremnant DHCP entries - which again will reduce the ammount of network traffic.

The router in Building 2 (it does not look like it is connected to a WAN of any kind?) if it is not, there is really no reason for it to be there,all it is doing at the moment is creating another Broadcast doamain for the 4 hosts attached to it - these four hosts could go straight into the switch.

Maybe look into getting a firewall hardware of software all you have protecting your network at the moment is whatever security features your router has!

All this is just my personal preference after looking at your drawing is all- obviously there is more than one way to configure a network! Someone elses idea may be totally different again!

Hope it helped!

I'm sorry I might not have explained that the best, the FTP server is actually for customers from remote computers and not only for our personal LAN... Also I botched the building 2 section, there is actually a dsl modem connected to the router, I just left it out accidentally...

It sounds like port knocking would be great for your network, granted your customers will need to get the proper sequence which could be a pain.

Try change FTP software, even windows FTP server is better than what you are using now.

Try changing the port to something else, at least this way he will have to show some initiative to find your FTP again.

Try Set-up a VPN so that they have to 2 factor authenticate before they can access your FTP