6

I've got a VPS server account for some projects and was just troubleshooting an issue earlier when the following turned up in the logs (among the torrent of bots trying to guess account details...). I'm rather surprised at this; the guest account is clearly disabled in Windows' user control panel.

Any ideas what might be happening here? 

An account was successfully logged on.

Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0

Logon Type:            3

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:        ANONYMOUS LOGON
    Account Domain:        NT AUTHORITY
    Logon ID:        0xed801aa
    Logon GUID:        {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:        0x0
    Process Name:        -

Network Information:
    Workstation Name:    WIN7USE-NAN0EX2
    Source Network Address:    114.38.156.233
    Source Port:        55598

Detailed Authentication Information:
    Logon Process:        NtLmSsp
    Authentication Package:    NTLM
    Transited Services:    -
    Package Name (NTLM only):    NTLM V1
    Key Length:        128

EDIT: Yes, the Windows Firewall is on and the machine is up-to-date with patches. Services running and externally accessible are IIS, DNS, hMailServer and Dropbox (for moving round backups, though that's temporarily disabled). Firewall rules are otherwise as default from the VPS supplier.

eftpotrm
  • 163
  • 1
  • 1
  • 5
  • Two questions: 1) `114.38.156.233` <- what is that IP? 2) Do you have the windows firewall turned on? If not, you really should do that. – EEAA Dec 21 '13 at 16:10
  • 1) That's the IP from the logs. Nothing to do with me, seems to be from Taiwan which didn't allay my fears. 2) Yes, Windows Firewall is on. Fairly default settings, with a bit of tweaking to let the email server and Dropbox communicate with the outside world. – eftpotrm Dec 21 '13 at 16:23
  • Well, I'd double-check your firewall settings if I were you. – EEAA Dec 21 '13 at 16:25
  • Thanks - any good reference guides out there for what rules it should have? – eftpotrm Dec 21 '13 at 16:47
  • Close *everything* and then open only what you need. That's all there is to it. – EEAA Dec 21 '13 at 16:48
  • Nerving myself up to disabling default firewall rules :-) Thanks. – eftpotrm Dec 21 '13 at 18:19

1 Answers1

9

First, ANONYMOUS LOGON is not the Guest account, so let's not conflate the two. They're separate things. Unless your server is grossly misconfigured, these events are probably harmless. For instance, Windows will never let someone log on interactively to the computer with an anonymous logon.

There are certain little bits of information that, by default, Windows will give out anonymously. For instance, another computer on the network attempting to enumerate file shares on your computer. That will log an anonymous logon. Because they didn't have to authenticate to a user account just to see if you're hosting any file shares.

You'll see such anonymous logons also referred to as null sessions. To create a null session, try this:

C:\>net use \\PC01\ipc$ "" /user:""
The command completed successfully.

That will trigger a security event exactly like the one you posted above. But I haven't exactly hacked your machine at this point... so it isn't much to worry about per se. There isn't much you can do with a null session. And you can further restrict it with GPOs/Local Security Policy:

  1. Network access: Allow anonymous SID/Name translation
  2. Network access: Do not allow anonymous enumeration of SAM accounts
  3. Network access: Do not allow anonymous enumeration of SAM accounts and shares
  4. Network access: Let Everyone permissions apply to anonymous users
  5. Network access: Named Pipes that can be accessed anonymously
  6. Network access: Shares that can be accessed anonymously

(These policies are in the Microsoft Management Console—MMC—Local Security Policy snap-in under Computer Configuration\Windows Settings\SecuritySettings\Local Policies\SecurityOptions.)

But as EEAA said, what you should worry about is that someone in Taiwan even has the required network connectivity to your machine to even make that network connection in the first place. That means your firewall has holes in it that you should close.

I would close everything except 3389 so that you can access your computer remotely, and port 80 and 443 if it's a web server... or just what you need, like EEAA said. We don't know what all your VPS does. :)

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • Thanks :-) The machine does web (port 80 only so far), email (IMAP and SMTP, ports specifically opened) and DNS. Everything else that's listed as open in the inbound firewall rules sounded very much like a Windows management service of some sort so I'd left well alone for fear of breaking things. I'll dig further. – eftpotrm Dec 21 '13 at 18:15