[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-users] Log Entry
- Subject: Re: [cobalt-users] Log Entry
- From: Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
- Date: Tue Jul 30 06:42:01 2002
- List-id: Mailing list for users to share thoughts on Sun Cobalt products. <cobalt-users.list.cobalt.com>
On Tue, 30 Jul 2002, Bob G7 wrote:
> While checking the RaQ4 log's this morning, I came across this entry and was
> wondering if it's anything I should be concerned about. And how can I stop
> it
>
> Jul 27 22:19:02 www proftpd[11366]: 65.70.90.26
> (ALimoges-101-1-3-102.abo.wanadoo.fr[80.11.195.102
> ]) - FTP session opened.
> Jul 27 22:19:02 www proftpd[11366]: 65.70.90.26
> (ALimoges-101-1-3-102.abo.wanadoo.fr[80.11.195.102
> ]) - FTP session closed.
>
> As I scanned the log file, it's showed up everyday at the same time since
> July 27th.
>
I doubt that he is doing anything other than scanning ftp servers for an
exploit.
I use /etc/hosts.deny
in.proftpd : .wanadoo.fr
That will keep them out of the ftp server...
--
Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
http://frontstreetnetworks.com | Website Hosts & SOHO Networks
229 Front Street, Ste.#C, New Haven, CT. 06513 United States
voice +1 203-785-0699 | fax +1 203-785-1787