[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[cobalt-users] possible ftp attack??
- Subject: [cobalt-users] possible ftp attack??
- From: "Michael Tubbe" <mtubbe@xxxxxxxxxxx>
- Date: Sat Oct 20 18:02:02 2001
- List-id: Mailing list for users to share thoughts on Cobalt products. <cobalt-users.list.cobalt.com>
I was looking at my log files and found this in /var/log/secure:
Oct 20 12:19:00 www proftpd[26204]: www.mydomain.com
(AMontpellier-201-1-6-88.abo.wanadoo.fr[80.11.171.88]) - USER anonymous: no
such user found from AMontpellier-201-1-6-88.abo.wanadoo.fr [80.11.171.88]
to xxx.xxx.xxx.xxx:21
The next line reads proftpd[26205], then a line for 06, all the way to a
line for 15.
Is this some sort of attack? If so, what are some possible next steps?
I found a second similar "attack". If it is an attach, how can it be
reported?
I looked in the archives, but was not sure if I was searching under the
correct terms. Any info would be helpful.
Is this the correct forum to be talking about this?
--
Michael Tubbe