> just amde a ftp server. iis 6.0 box sits on the ISP outside the
> firewall.
[quoted text clipped - 5 lines]
> still says it accepts the username. is this normal behavior or did I miss
> something in the security setup?
no i can't log in with the administrator account. it still concerns me that
the administrator account and the anonymous user are accepted users
> Are you actually logging in with the Administrator account?
>
[quoted text clipped - 14 lines]
> > still says it accepts the username. is this normal behavior or did I miss
> > something in the security setup?
Bernard Cheah [MVP] - 29 Aug 2006 04:54 GMT
Well, it just like unknown users to the FTP server.
Of coz it will still accept it, but it will not authenticate it
successfully.
You can't prevent someone to knock on your door, right?

Signature
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/
> no i can't log in with the administrator account. it still concerns me
> that
[quoted text clipped - 22 lines]
>> > miss
>> > something in the security setup?
Funkadyleik Spynwhanker - 29 Aug 2006 17:08 GMT
> no i can't log in with the administrator account. it still concerns me
> that
> the administrator account and the anonymous user are accepted users
Ok, well you are misunderstanding the issue then.
Rejecting Users = bleeding data to an attacker. Telling them "Yes exists,
or No does not exist". If you get any kind of auditing, you will get dinged
for that as it opens you up to all sorts of social engineering attacks as
well as a focused brute force attack on the existing accounts. A single
variable isolated (the username) makes the problem to a "couple of months"
problem from a "longer than the universe has existed" problem.
Not rejecting users = giving them _nothing_ to start getting a foothold on.
You are thinking the first one is safer than the second one, which is
incorrect. The server should simply fail to login in _exactly_the_same_way_
no matter what it is that is wrong. Anything else, and you are giving away
information you don't want out there. You deleted the administration
account, now why do you want to ADVERTISE that fact?