vsftpd starting large numbers of sub-processes

glt · 04-29-2009, 11:20 AM

Hi,

We have been running a vsftpd daemon on our
server for several years without problems.
In the last few days the vsftpd has started firing
up mulitple sub-processes. This results in large
amounts of traffic on our network. No configuration
changes have been made to the server in many months.

1) Is this a DOS or a problem with vsftpd
2) Can I prevent this from recurring?

Env:
Redhat Linux Release 9
2.4.20-30.9
Yes. Its way old! Nothing I can do about that.

Cheers,
Geoff

chrism01 · 04-29-2009, 10:58 PM

Can you see from the logs what those processes are doing? Tie them to connection recs in /var/log/messages? Try getting the firewall to log connections to that port (21). That should show you if you're getting hammered by script kiddies/botnets.
Just to point out that anything that old is ripe for exploits ie hasn't had a security update in years ... maybe this will turn out to be the requirement you can take to the boss to justify running a current system.

suhas! · 04-30-2009, 01:41 AM

You can just get to know who are logged into the server from ps aux output. Just see if those are legitimate users.

You can also look out for any source IP generating a large number of request to your server.

# netstat -antp

Just check for "foreign address" column. Is any particular IP having too many connections?

Regards

glt · 04-30-2009, 09:06 AM

Hi guys,

Thanks for the replies.
Well. The server is a public Anonymous ftp server.
It is common for it to get requests from IPs all
over the world. To answer suhas!'s question:
yes some of the IPs generate way too many connections
>10 in some cases. Is there a vsftpd.config entry
to limit the number of concurrent connections from
one IP?

Cheers,
Geoff

suhas! · 04-30-2009, 10:12 AM

You can use max_per_ip directive in vsftpd.conf.

Reference : http://www.cyberciti.biz/faq/howto-l...d-connections/

Please let us know if it helps

Regards.

glt · 04-30-2009, 11:33 AM

Hi guys.

That's perfect! Thanks!

Cheers,
Geoff