From: Hutchins, Greg (ghutchins2@selfregional.org)
Date: Mon Oct 04 2004 - 09:34:03 EDT
Hello all. I am receiving a lot of failed login (ftp) attempts on one
of my systems in syslog. I have tried lastb to find more information
with no luck. There is no username in /etc/passwd that matches the
failed login user. I think it is a script running off of another one of
our servers. Any idea on how to find more information about this failed
ftp login and where it's coming from? Thanks in advance for the help!
Sample syslog message with hostname and user removed:
Oct 1 19:00:05 hostname ftpd[1731]: User user1: Login incorrect
Oct 1 19:00:05 hostname ftpd[1731]: FTP session closed
--
---> Please post QUESTIONS and SUMMARIES only!! <---
To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
Name: hpux-admin@dutchworks.nl Owner: owner-hpux-admin@dutchworks.nl
Archives: ftp.dutchworks.nl:/pub/digests/hpux-admin (FTP, browse only)
http://www.dutchworks.nl/htbin/hpsysadmin (Web, browse & search)
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 11:02:43 EDT