Re: [cobalt-security] /var/log/secure messages

[Jeff Lovell <jlovell@xxxxxxxxxx>]

Theodore Jones wrote:
> 
> Hey all,
> 
> I'm getting messages like the following in my /var/log/secure file which
> are confusing to me:
> 
> May 31 06:00:02 www in.proftpd[687]: connect from 127.0.0.1
> May 31 06:00:03 www imapd[688]: connect from 127.0.0.1
> May 31 06:00:07 www in.qpopper[689]: connect from 127.0.0.1
> May 31 06:15:03 www in.proftpd[952]: connect from 127.0.0.1
> May 31 06:15:04 www imapd[954]: connect from 127.0.0.1
> May 31 06:15:07 www in.qpopper[955]: connect from 127.0.0.1
> May 31 06:30:01 www in.proftpd[1198]: connect from 127.0.0.1
> 
> .... isn't 127.0.0.1 the loopback IP for the machine itself?

Active monitor checking the system.

Jeff