The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Proftpd crazy logs and server failure

Discussion in 'General Discussion' started by Skysaber, Jun 28, 2003.

  1. Skysaber

    Skysaber Member

    Joined:
    Feb 23, 2003
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Nashville TN
    Hey, has anyone else had there server go down and when you look at the log files it's an unending list of proftpd messages like:

    Jun 28 00:04:27 linux1 proftpd[16890]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.
    Jun 28 00:12:47 linux1 proftpd[16954]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session opened.
    Jun 28 00:12:47 linux1 proftpd[16954]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.
    Jun 28 00:21:08 linux1 proftpd[17104]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session opened.
    Jun 28 00:21:08 linux1 proftpd[17104]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.
    Jun 28 00:29:28 linux1 proftpd[17162]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session opened.
    Jun 28 00:29:28 linux1 proftpd[17162]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.
    Jun 28 00:37:48 linux1 proftpd[17224]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session opened.
    Jun 28 00:37:48 linux1 proftpd[17224]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.
    Jun 28 00:46:08 linux1 proftpd[17289]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session opened.
    Jun 28 00:46:08 linux1 proftpd[17289]: linux1.bucketcode.com (localhost[127.0.0.1]) - FTP session closed.

    2nd time it's happened to me, looking for some insight. I am on RedHat 7.3 by the way. Thanks.

    cPanel.net Support Ticket Number:
     
  2. MikeMc

    MikeMc Well-Known Member

    Joined:
    May 8, 2002
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    16
    If you see thousands of these entries...then for sure this is an attack. I don't think that there is much to worry about except from the reason that someone has decided to attack your ftp server. A solution... is when the attack starts to block him using iptables and hosts.deny just to be sure.

    cPanel.net Support Ticket Number:
     
  3. sexy_guy

    sexy_guy Well-Known Member

    Joined:
    Mar 19, 2003
    Messages:
    848
    Likes Received:
    0
    Trophy Points:
    16
    No its not. That is normal, the connection is from localhost 127.0.0.1 and not from the outside. This is just like when you see Apache restarting every 10min. A cpanel thing!

    cPanel.net Support Ticket Number:
     
  4. MikeMc

    MikeMc Well-Known Member

    Joined:
    May 8, 2002
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    16
    Yes you're right sexy_guy. I haven't seen the 127.0.0.1 ...I think that I just stopped reading...:) to the "unending" entries... sorry.

    cPanel.net Support Ticket Number:
     
  5. Skysaber

    Skysaber Member

    Joined:
    Feb 23, 2003
    Messages:
    17
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Nashville TN
    Thanks

    Thanks guys, still not sure why my box is going down. But glad to know that it doesn't appear malicious, I was skeptic of that. I'll research further.

    cPanel.net Support Ticket Number:
     
Loading...

Share This Page