RE: [cobalt-users] Log Entry

[Bob G7 <Bob_G7@xxxxxxxxxx>]

> On Tue, 30 Jul 2002, Bob G7 wrote:
> 
> > While checking the RaQ4 log's this morning, I came across this 
> entry and was
> > wondering if it's anything I should be concerned about. And how 
> can I stop
> > it
> >
> > Jul 27 22:19:02 www proftpd[11366]: 65.70.90.26
> > (ALimoges-101-1-3-102.abo.wanadoo.fr[80.11.195.102
> > ]) - FTP session opened.
> > Jul 27 22:19:02 www proftpd[11366]: 65.70.90.26
> > (ALimoges-101-1-3-102.abo.wanadoo.fr[80.11.195.102
> > ]) - FTP session closed.
> >
> > As I scanned the log file, it's showed up everyday at the same 
> time since
> > July 27th.
> >
> I doubt that he is doing anything other than scanning ftp servers for an
> exploit.
> I use /etc/hosts.deny
> in.proftpd : .wanadoo.fr
> 
> That will keep them out of the ftp server...
> 
> --
Thanks for your help, made the change and will keep an eye on it.