Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
| Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
06-19-2006, 07:34 PM
|
#1
|
|
Member
Registered: Jul 2005
Location: Maine, USA
Distribution: OpenSUSE, Gentoo, Fedora, Ubuntu, Mandriva, others
Posts: 413
Rep: 
|
Weirdness with ProFTPd and Logwatch: hacked?
This morning, I read my logwatch message for my server, there was some interesting entries under the ProFTPd section. I looked at it a while, but I can't really figure out the whole thing.
Here are the entries:
Code:
----------- proftpd-messages Begin --------------
**Unmatched Entries**
<My Hostname> - received SIGHUP -- master server rehashing
configuration file
IPv6 getaddrinfo '<My Domain>' error: Name or service not known
<My Hostname> - error setting IPV6_V6ONLY: Protocol not available
<My Hostname> - received SIGHUP -- master server rehashing
configuration file
IPv6 getaddrinfo '<My Domain>' error: Name or service not known
<My Hostname> - error setting IPV6_V6ONLY: Protocol not available
<My Domain> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
<My Hostname> (::ffff:210.240.212.199[::ffff:210.240.212.199])
- error setting SO_OOBINLINE: Socket operation on non-socket
------------ proftpd-messages End ---------------
After I saw these messages, I tried to connect to my FTP server and got an error 500. I shutdown my FTP server, because I don't need it for anything, but still, I'm curious about this. |
|
|
|
|
06-19-2006, 08:15 PM
|
#2
|
|
Moderator
Registered: May 2001
Posts: 29,415
|
Not hacked enough*, I would guess: if you run Proftpd < 1.3.0rc4 then you could try upgrading.
*which of course is in reference to your title as it's not "hacked" (good) but "cracked" (bad) and there's nothing wrong with Logwatch.
|
|
|
|
|
06-19-2006, 09:34 PM
|
#3
|
|
Member
Registered: Jul 2005
Location: Maine, USA
Distribution: OpenSUSE, Gentoo, Fedora, Ubuntu, Mandriva, others
Posts: 413
Original Poster
Rep:
|
Yeah yeah, I know. But what exactly are those entries saying?
|
|
|
|
|
06-19-2006, 09:59 PM
|
#4
|
|
Moderator
Registered: May 2001
Posts: 29,415
|
But what exactly are those entries saying?
0. Exactly what it says: it's "asked" to reread the config,
1. go read the Proftpd FAQ.
|
|
|
|
All times are GMT -5. The time now is 10:55 PM.
|
|
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
|
 Latest Threads
LQ News
|
|
