Re: [cobalt-users] Problems With FTP shutting down

[flash22@xxxxxxx]

On Sun, 2 Sep 2001, Dave wrote:

> 
> > I have a RaQ2 that this happens to occassionally. Almost everytime this
> > happens, I can find corresponding entries in the /var/log/messages where
> > I've been hit by mega-multiple instances of someone running all my IPs
> > through their auto anonymous FTP login program. They hit so hard and fast
> > that FTP goes down and the error generated is for example:
> >
> > Aug 30 17:10:47 XXXX inetd[16259]: ftp/tcp server failing (looping),
> > service terminated
> 
> Hey that's it! :) Not that it's a good thing, but at least I know now. Is
> there any way of blocking this, so that it's not happening all the time So
> far I've pinned down three different IP addresses..... but not sure what I
> can do.  Thanks for the tip on the logs Diana!

This helps a little, in proftp.conf, add

MaxClientsPerHost               2

This at least makes it refule a little faster, tho the connects from a
scan are so dammed fast it can't see it half the timee, sigh

gsh