/var/log/secure ???

MikeFoo1 · 06-21-2005, 07:57 PM

Quote:

May 7 14:44:10 XXX proftpd[1243]: connect from 82.227.73.36
May 12 21:50:36 XXXX proftpd[2490]: connect from 82.121.62.174
May 12 21:56:02 XXXX proftpd[2499]: connect from 211.107.232.1

Do these entries mean that someone was successful in connecting to my system or are they *failed* attempts ?

Thanks.

IchBin · 06-22-2005, 12:37 AM

I'm not sure as I dont use FTP. Doesn't proftp log to its own file though? YOu should check those logs as these might just be attempts. Also you might want to check if proftp later rejected those IP's in the secure log.

MikeFoo1 · 06-22-2005, 04:42 AM

Quote:

Originally posted by IchBin
I'm not sure as I dont use FTP. Doesn't proftp log to its own file though? YOu should check those logs as these might just be attempts. Also you might want to check if proftp later rejected those IP's in the secure log.

Thanks for your reply . I am not too sure as i have already disabled ftp (ports 20,21) in /etc/services ?!

I have come across this as well :

Quote:

In inetd mode, the proftpd server expects to be started by the inetd (or xinetd) servers. It is these servers, inetd/xinetd, that listen on the FTP port (usually 21) for connection requests, then start proftpd and pass the connection off. This mode is usually best suited for low traffic sites, for sites that do not handle many FTP sessions.

So , do i have to edit /etc/inetd.conf as well ?