Topic: NtLmSsp attack ?

[bagu]

Hello, I regularly receive attacks, obviously through Apache, of this type:

[James Blond]

In that error message is nothing from apache as far as I can see rather than a login try on the windows system itself.

if you are sure, that is is apache mod security can help.

[tangent]

@bagu - You say these event log entries are obviously through Apache, but don't provide any details of your Apache configuration, or the content/application being served through Apache. The only clue in the failed login detail you've posted is the client IP address 23.253.164.50, which appears to be located in the US.

If external users are connecting to Apache on your server, then I'd guess there's some content being served, either from a network share or local resource, that's protected. Without appropriate NTLM credentials, access is denied, and an event log entry is duly created.

[bagu]

Hello,

It is true that I was not very exhaustive in the details.
In fact, when I shut down apache, I don't receive these messages anymore.
That's what told me that Apache was concerned.
However, my server only shares local resources.

I think I have a problem somewhere, because I have, for example, access attempts on https://localhost even though this should not be possible.
So I'm trying to find out how there can be access attempts outside the directories containing my public sites.

I'm going to look at the module recommended by James Blond, but at the same time I'm still trying to find out if there is a defect in the configuration of my virtualhosts.

[bagu]

Hello,

It is true that I was not very exhaustive in the details.
In fact, when I shut down apache, I don't receive these messages anymore.
That's what told me that Apache was concerned.
However, my server only shares local resources.

I think I have a problem somewhere, because I have, for example, access attempts on https://localhost even though this should not be possible.
So I'm trying to find out how there can be access attempts outside the directories containing my public sites.

I'm going to look at the module recommended by James Blond, but at the same time I'm still trying to find out if there is a defect in the configuration of my virtualhosts.

Translated with www.DeepL.com/Translator (free version)

[tangent]

Can you not tie up the time of one of these event log error entries, to an access request in the Apache logs?

That would then show you the resource being requested via Apache.

Depending on what account you're running Apache under, could there be some local resource ACL restrictions that someone's applied?

[bagu]