IIS FTP Password Problems

[Guest]

Friends,

We are using IIS ftp to backup configuration files from remote devices. Up
until two week ago everything worked just fine. One of our evening call
center folks complained that the remote devices failed backup.

I was able to start an ftp connection from a client at another location, but
the password failed. I am getting ready to uninstall and re-install IIS, but
thought I might check here first before major surgery.

 

[Steven L Umbach]

Check the security log on the server running FTP to see if it shows the
reason the password failed or any other related events that occurred at the
same time. Maybe someone changed the password or the password has expired
for the account used. --- Steve

 

[Roger Abell [MVP]]

Why consider reinstall when it sounds like a matter of the
password having been changed, or not changed and expiring ?

 

[Guest]

Steven,

All good points and thank you. The security log is emply actually. That
sound bad is my guess. I've changed the password as you suggested some time
ago. The password for this account does not expire, but one nevers knows.

I also check the application log, but all I could see in there was our
recent database/billing system upgrade.

I also tried to reset the NTFS permission using Article ID 271071 Rev 13.2.
That didn't help either.

I must confess that I am not a Windows Server expert. My expertise deals
with IP networking, so if there are other thing which may seem obvious to
you, it might not be to me.

Your assisance is welcome.

Mac

 

[Guest]

Roger,

Thanks for your input. I thought the same thing as well as the other tech.
If you see my response to Steven, I provided more information about what I
did.

Mac

 

[Roger Abell [MVP]]

For one thing, keep in mind that what appears in the security
event log will depend on what has been configured to be logged
(see the local security policy in the audit section).

Since the password for ftp login travels the network in clear
text (unless within such as IPsec ESP communication) it can
be really only a matter of who is able to sniff the traffic. Then
you can change the password any you are at point where you
experience what you report.

So, are you saying that you have just now reset the password
to a known value with Windows and then altered the process
that tries to use this so it knows the new value, etc. and that
you still are getting this login failure?

 

[Guest]

Sorry for not being clearer. First I tried just resetting the password.
That didn't work, so I deleted the account and put it back in the system.
When that didni't work I tried resetting NTFS by following the procedure
outlined in that article I mentioned earlier. That didn't help either.

The only reason I am suspecious of IIS is that we cn still log on the server
to access our file services and other applications.

Another think I noticed on Friday. I deleted the Default FTP server and
reinstalled it. I received an error message that "the address was already in
use." I am wondering if the previous tech installed an ftp server I'm not
aware.

Thanks for the head up on the policy for logging. I'll check that more
thoroughly on Monday.

And thanks in general. I am not a MS server person by a long shot. My suit
is IP networks and the like. I'm a niewbe in the MS world.

Mac

 

[Roger Abell [MVP]]

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

 

[Guest]

Roger,

I agree. Any ideas where I would start?

Mac

 

[Roger Abell [MVP]]

I do not see mention of OS version, but given your selected newsgroup
I will assume W2k. I do not recall exactly, but believe that the event log
message written for IP conflicts only began to capture the MAC at XP
and W2k3. Basically, if you are seeing the popup that I think you are,
that there is a conflict with another machine on the network using the
same IP, then you need to chase this down through your switches/routers.

 

[Guest]

Sorry Roger,

This is a Windows 2000 Server. The office machines are using XP. We run
DHCP from an LinkSys router. I checked the IP address distribution as you
suggested and did not find any duplicates. The router start at .101 with
..106--.112 assigned through DHCP (only addresses between .100-.150 are
distributed in this manner).

Our printer is at .210, an internal web server is .220, and the two system
servers are at .253 and .254. The network mask is set at 255.255.255.0.
This is the only network in the office.

I've had a similar problem with an application called tftp32d. We use DHCP
at several locations for IP address administration. When the application was
installed and turned on we used to get the same error message (Address
already in use). I found that this application not only included a tftp
service, but also had a DHCP services. I assumed that the address tftp was
complaining about was the port number conflict between Window's DHCP, which
was already running, and the tftp32d application trying to run its DHCP
program.

I'm wondering if I'm running into the same thing here? Any thoughts?

Mac

 

[Guest]

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools from
www.sysinternals.com to look at the open ports on your computer and the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows Rootkits
are used to hide the existence of the FTP server. You can google search for
pubstro or ftp-tagging for more info on this phenomenon. You will sometimes
notice an unexplained drop in amount of free disk space on your hard drive.

Maybe you've already been given this information, but here is information on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info

 

[Guest]

Karl,

Thank you very much. I'll give this a shot tomorrow. This si too funny.
We are getting ready to swap ISPs at one of our sites and my time has been
taken engineering our network with the new IP address scheme...no rest for
the wicked.

Again thanks...

Mac
--
We are not Borg...

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools from
www.sysinternals.com to look at the open ports on your computer and the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows Rootkits
are used to hide the existence of the FTP server. You can google search for
pubstro or ftp-tagging for more info on this phenomenon. You will sometimes
notice an unexplained drop in amount of free disk space on your hard drive.

Maybe you've already been given this information, but here is information on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

 

[Roger Abell [MVP]]

Karl,

Thank you very much. I'll give this a shot tomorrow. This si too funny.
We are getting ready to swap ISPs at one of our sites and my time has been
taken engineering our network with the new IP address scheme...no rest for
the wicked.

Again thanks...

Mac

or, no rest for the good (at what they do, at least in IT)

I am still not sure whether you are getting a Network Sense popup,
from Windows network stack, or if you are getting a message from
one application that cannot bind to a port (along lines of some of what
Karl has just discussed).

Roger
(We are not Borg - despite what mgmt thinks)

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or
Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools
from
www.sysinternals.com to look at the open ports on your computer and the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP
which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows
Rootkits
are used to hide the existence of the FTP server. You can google search
for
pubstro or ftp-tagging for more info on this phenomenon. You will
sometimes
notice an unexplained drop in amount of free disk space on your hard
drive.

Maybe you've already been given this information, but here is information
on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

Sorry for not being clearer. First I tried just resetting the
password.
That didn't work, so I deleted the account and put it back in the
system.
When that didni't work I tried resetting NTFS by following the
procedure
outlined in that article I mentioned earlier. That didn't help
either.

The only reason I am suspecious of IIS is that we cn still log on the
server
to access our file services and other applications.

Another think I noticed on Friday. I deleted the Default FTP server
and
reinstalled it. I received an error message that "the address was
already
in
use." I am wondering if the previous tech installed an ftp server
I'm not
aware.

Thanks for the head up on the policy for logging. I'll check that
more
thoroughly on Monday.

And thanks in general. I am not a MS server person by a long shot.
My
suit
is IP networks and the like. I'm a niewbe in the MS world.

Mac
--
We are not Borg...


:

For one thing, keep in mind that what appears in the security
event log will depend on what has been configured to be logged
(see the local security policy in the audit section).

Since the password for ftp login travels the network in clear
text (unless within such as IPsec ESP communication) it can
be really only a matter of who is able to sniff the traffic. Then
you can change the password any you are at point where you
experience what you report.

So, are you saying that you have just now reset the password
to a known value with Windows and then altered the process
that tries to use this so it knows the new value, etc. and that
you still are getting this login failure?

Roger,

Thanks for your input. I thought the same thing as well as the
other
tech.
If you see my response to Steven, I provided more information
about
what I
did.

Mac
--
We are not Borg...


:

Why consider reinstall when it sounds like a matter of the
password having been changed, or not changed and expiring ?

Friends,

We are using IIS ftp to backup configuration files from remote
devices.
Up
until two week ago everything worked just fine. One of our
evening
call
center folks complained that the remote devices failed backup.

I was able to start an ftp connection from a client at another
location,
but
the password failed. I am getting ready to uninstall and
re-install
IIS,
but
thought I might check here first before major surgery.

 

[Guest]

Roger,

The Default FTP server is stopped according to ISM. When I open the ISM
window I see the services listed and the parenthiese at the FTP service is
(Stopped). When I try to start it using the right click and selecting start,
I get the error message "Address already in use." The message window is
posted by ISM I assume as "Internet Service Manager" is recorded in the
header of the box.

Cheers,

Mac
--
We are not Borg...

Karl,

Thank you very much. I'll give this a shot tomorrow. This si too funny.
We are getting ready to swap ISPs at one of our sites and my time has been
taken engineering our network with the new IP address scheme...no rest for
the wicked.

Again thanks...

Mac

or, no rest for the good (at what they do, at least in IT)

I am still not sure whether you are getting a Network Sense popup,
from Windows network stack, or if you are getting a message from
one application that cannot bind to a port (along lines of some of what
Karl has just discussed).

Roger
(We are not Borg - despite what mgmt thinks)

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or
Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools
from
www.sysinternals.com to look at the open ports on your computer and the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP
which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows
Rootkits
are used to hide the existence of the FTP server. You can google search
for
pubstro or ftp-tagging for more info on this phenomenon. You will
sometimes
notice an unexplained drop in amount of free disk space on your hard
drive.

Maybe you've already been given this information, but here is information
on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info




:

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

Sorry for not being clearer. First I tried just resetting the
password.
That didn't work, so I deleted the account and put it back in the
system.
When that didni't work I tried resetting NTFS by following the
procedure
outlined in that article I mentioned earlier. That didn't help
either.

The only reason I am suspecious of IIS is that we cn still log on the
server
to access our file services and other applications.

Another think I noticed on Friday. I deleted the Default FTP server
and
reinstalled it. I received an error message that "the address was
already
in
use." I am wondering if the previous tech installed an ftp server
I'm not
aware.

Thanks for the head up on the policy for logging. I'll check that
more
thoroughly on Monday.

And thanks in general. I am not a MS server person by a long shot.
My
suit
is IP networks and the like. I'm a niewbe in the MS world.

Mac
--
We are not Borg...


:

For one thing, keep in mind that what appears in the security
event log will depend on what has been configured to be logged
(see the local security policy in the audit section).

Since the password for ftp login travels the network in clear
text (unless within such as IPsec ESP communication) it can
be really only a matter of who is able to sniff the traffic. Then
you can change the password any you are at point where you
experience what you report.

So, are you saying that you have just now reset the password
to a known value with Windows and then altered the process
that tries to use this so it knows the new value, etc. and that
you still are getting this login failure?

Roger,

Thanks for your input. I thought the same thing as well as the
other
tech.
If you see my response to Steven, I provided more information
about
what I
did.

Mac
--
We are not Borg...


:

Why consider reinstall when it sounds like a matter of the
password having been changed, or not changed and expiring ?

Friends,

We are using IIS ftp to backup configuration files from remote
devices.
Up
until two week ago everything worked just fine. One of our
evening
call
center folks complained that the remote devices failed backup.

I was able to start an ftp connection from a client at another
location,
but
the password failed. I am getting ready to uninstall and
re-install
IIS,
but
thought I might check here first before major surgery.

 

[Guest]

Karl,

First thank you for the tool kit link. I have found the enemy and it is
UpGradeManager. My ignorance shines forth. The fport did exactly as
advertised and as soon as I saw UpGradeManager grabbing port 21 it took me
all of 35 seconds to fix the problem.

Best Regards,

Mac
--
We are not Borg...

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools from
www.sysinternals.com to look at the open ports on your computer and the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows Rootkits
are used to hide the existence of the FTP server. You can google search for
pubstro or ftp-tagging for more info on this phenomenon. You will sometimes
notice an unexplained drop in amount of free disk space on your hard drive.

Maybe you've already been given this information, but here is information on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

 

[Roger Abell [MVP]]

Aahhh Yes, then something else that is installed on that machine
has already bound to the FTP ports
Previously I was taking you as saying you were seeing the popup
from the network sense capability saying to effect "a duplicate IP
has been detected on the network"

Roger,

The Default FTP server is stopped according to ISM. When I open the ISM
window I see the services listed and the parenthiese at the FTP service is
(Stopped). When I try to start it using the right click and selecting
start,
I get the error message "Address already in use." The message window is
posted by ISM I assume as "Internet Service Manager" is recorded in the
header of the box.

Cheers,

Mac
--
We are not Borg...

Karl,

Thank you very much. I'll give this a shot tomorrow. This si too
funny.
We are getting ready to swap ISPs at one of our sites and my time has
been
taken engineering our network with the new IP address scheme...no rest
for
the wicked.

Again thanks...

Mac

or, no rest for the good (at what they do, at least in IT)

I am still not sure whether you are getting a Network Sense popup,
from Windows network stack, or if you are getting a message from
one application that cannot bind to a port (along lines of some of what
Karl has just discussed).

Roger
(We are not Borg - despite what mgmt thinks)

:

Agreed. Use Vision [or Fport] from www.foundstone.com/knowledge or
Active
Ports from www.webattack.com/get/activeports.shtml or pslist / pstools
from
www.sysinternals.com to look at the open ports on your computer and
the
program or executable using that port. Some firewall software such as
www.sygate.com will also tell you this information.

If that doesn't help, then try these things:

http://www.securityadmin.info/faq.asp?hacked

Note that hackers can and do install FTP software such as Serv-U FTP
which
can grab TCP ports 21 and/or 20 before IIS can. Sometimes Windows
Rootkits
are used to hide the existence of the FTP server. You can google
search
for
pubstro or ftp-tagging for more info on this phenomenon. You will
sometimes
notice an unexplained drop in amount of free disk space on your hard
drive.

Maybe you've already been given this information, but here is
information
on
troubleshooting the IIS account password, if that is the problem:

http://www.securityadmin.info/faq.asp?iwam

kind regards,
Karl Levinson, CISSP, CCSA, MCSE, MS MVP
-------------------------
Microsoft Security FAQ:
http://www.securityadmin.info




:

No problem. I sounds to me that you need to get to the bottom
of the "the address was already in use." message.

Sorry for not being clearer. First I tried just resetting the
password.
That didn't work, so I deleted the account and put it back in the
system.
When that didni't work I tried resetting NTFS by following the
procedure
outlined in that article I mentioned earlier. That didn't help
either.

The only reason I am suspecious of IIS is that we cn still log on
the
server
to access our file services and other applications.

Another think I noticed on Friday. I deleted the Default FTP
server
and
reinstalled it. I received an error message that "the address was
already
in
use." I am wondering if the previous tech installed an ftp server
I'm not
aware.

Thanks for the head up on the policy for logging. I'll check that
more
thoroughly on Monday.

And thanks in general. I am not a MS server person by a long
shot.
My
suit
is IP networks and the like. I'm a niewbe in the MS world.

Mac
--
We are not Borg...


:

For one thing, keep in mind that what appears in the security
event log will depend on what has been configured to be logged
(see the local security policy in the audit section).

Since the password for ftp login travels the network in clear
text (unless within such as IPsec ESP communication) it can
be really only a matter of who is able to sniff the traffic.
Then
you can change the password any you are at point where you
experience what you report.

So, are you saying that you have just now reset the password
to a known value with Windows and then altered the process
that tries to use this so it knows the new value, etc. and that
you still are getting this login failure?

Roger,

Thanks for your input. I thought the same thing as well as the
other
tech.
If you see my response to Steven, I provided more information
about
what I
did.

Mac
--
We are not Borg...


:

Why consider reinstall when it sounds like a matter of the
password having been changed, or not changed and expiring ?

Friends,

We are using IIS ftp to backup configuration files from
remote
devices.
Up
until two week ago everything worked just fine. One of our
evening
call
center folks complained that the remote devices failed
backup.

I was able to start an ftp connection from a client at
another
location,
but
the password failed. I am getting ready to uninstall and
re-install
IIS,
but
thought I might check here first before major surgery.

 

[Guest]

All good points and thank you. The security log is emply actually. That

use local security policy to enable auditing. Activate auditing for failed
logins and you'll get some clues.