LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Several weird logins from localhost in proftp (https://www.linuxquestions.org/questions/linux-software-2/several-weird-logins-from-localhost-in-proftp-863304/)

brgsousa 02-17-2011 07:30 AM

Several weird logins from localhost in proftp
 
I am using Debian 4 with proftp 1.3.1

The log file shows lots of successful logins from localhost. I never accessed ftp from localhost. Is this normal to happen?
Code:

Feb 14 11:27:22 mymachine proftpd[2453] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): USER ftpuser: Login successful.
Feb 14 14:27:22 mymachine proftpd[2453] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): Preparing to chroot to directory '/home/comunicacao/portal'
Feb 14 14:27:23 mymachine proftpd[2453] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): FTP session closed.
Feb 14 11:36:41 mymachine proftpd[2873] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): FTP session opened.
Feb 14 11:36:41 mymachine proftpd[2873] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): USER ftpuser: Login successful.
Feb 14 14:36:41 mymachine proftpd[2873] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): Preparing to chroot to directory '/home/comunicacao/portal'
Feb 14 14:36:42 mymachine proftpd[2873] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): FTP session closed.
Feb 14 15:53:42 mymachine proftpd[13637] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): FTP session opened.
Feb 14 15:53:42 mymachine proftpd[13637] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): USER ftpuser: Login successful.
Feb 14 18:53:42 mymachine proftpd[13637] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): Preparing to chroot to directory '/home/comunicacao/portal'
Feb 14 18:53:42 mymachine proftpd[13637] mymachine.mydomain.com (localhost.localdomain[127.0.0.1]): FTP session closed.


thegeek 02-17-2011 11:19 AM

Some cms's use an ftp layer to change files, could be that ... but is the user one you know about ?

brgsousa 02-17-2011 11:25 AM

You're right!
The only service that this server runs is a Joomla install :)
Thanks!


All times are GMT -5. The time now is 04:59 PM.