Re: [cobalt-users] FTP Attack ??

[Mailing List <listonly@xxxxxxxxxxxxxxxxxxxx>]

On 4/30/03 11:18 AM, "Matt" wrote:

> Hello,
> 
> I would of checked the archives for this, but they seem to be down:
> http://list.cobalt.com/mailman/listinfo/cobalt-users/
> 
> Anyway, Last night I saw a TON of FTP logins for user "nobody" in turn
> causing the machine to crash and burn slowly but surely. Has anyone else
> seen this, is there a way to prevent this type of attack? I am running
> proftpd on a RAQ550 (default install). I was thinking about just changing
> the default User and Group to something different to see if that would make
> a difference.
> 

Matt
We get these all the time. I have been adding them to a block list in the
/etc/hosts.deny files

in.proftpd: 123.456.789.0 DENY

I think that¹s correct, early morning here.

I then see the same IP attempting to get in again later. Depending on my
mood and the number of attempts, I may block the whole C, B or A class after
doing a Sam spade on them :)
-- 
Thanks!!
David Thurman
List Only at Web Presence Group Net
Join Cobaltfacts
http://list.cobaltfacts.com/mailman/listinfo/cobaltfacts/

Mambo Users
mambo-users@xxxxxxxxxxxxxxxxxxxxx

Mambo Dev
mambo-dev@xxxxxxxxxxxxxxxxxxxxx