[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[cobalt-security] Proftp Log Question

Greetings, I was taking a look around my messages file tonight trying to
figure out a DNS problem, and I came accross something I had seen before,
but I'm seeing more of it now.  Basicly it looks to me like the localhost is
trying to connect to FTP every 15 minutes or so.

Now I did read something back in May from Dan K. and Carrie B. about this
being an automatic thing (but with different tld names).  Is this something
I should be worried about?

REF: http://list.cobalt.com/pipermail/cobalt-security/2001-May/002031.html

Aug 27 23:45:04 www proftpd[28495]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session opened.
Aug 27 23:45:04 www proftpd[28495]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 27 23:45:04 www proftpd[28495]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 27 23:45:04 www proftpd[28495]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session closed.
Aug 28 00:00:02 www proftpd[29084]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session opened.
Aug 28 00:00:02 www proftpd[29084]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 28 00:00:02 www proftpd[29084]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 28 00:00:03 www proftpd[29084]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session closed.
Aug 28 00:15:03 www proftpd[29682]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session opened.
Aug 28 00:15:03 www proftpd[29682]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 28 00:15:03 www proftpd[29682]: www.smarthostplan.com
(localhost[127.0.0.1]) - no such user 'anonymous'
Aug 28 00:15:03 www proftpd[29682]: www.smarthostplan.com
(localhost[127.0.0.1]) - FTP session closed.

--
Christopher Lange
chris@xxxxxxxxxxxxxxx
307-851-2917 (direct voice)