weird ftp-related logcheck msgs
Redmond Militante
r-militante at northwestern.edu
Fri Oct 10 10:12:22 PDT 2003
hi all
the last couple of days, i've noticed strange security notifications sent to the root user of one of my boxen. this box is running proftpd as an ftp server. the messages appear whenever somebody authenticates via ftp. most often, it's me ftp'ing to the machine, so it's probably not someone doing something malicious (just in case, i ran chkrootkit and yafic, which turn up clean...)
the messages look like
Oct 10 11:27:06 server proftpd[45750]: server.com
+(my.box.com[129.xxx.xx.xx]) - PAM(secure): Permission denied.
Oct 10 11:17:25 server sendmail[45703]: h9AGHPbK045703: h9AGHPbL045703: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:17:41 server sendmail[45708]: h9AGHfPB045708: h9AGHfPC045708: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:18:43 server sendmail[45715]: h9AGIhBK045715: h9AGIhBL045715: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:13 server sendmail[45720]: h9AGJDEV045720: h9AGJDEW045720: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:29 server sendmail[45725]: h9AGJTMA045725: h9AGJTMB045725: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:56 server sendmail[45730]: h9AGJuBg045730: h9AGJuBh045730: DSN: To:... List:;
+syntax illegal for recipient addresses
i'm not sure what to make of these messages. ftp still seems to work (fyi - i upgraded to the latest version of proftpd today - 1.2.8 stable, didn't fix the situation though), my server is
FreeBSD server.com 4.7-RELEASE-p23 FreeBSD 4.7-RELEASE-p23 #0: Fri Oct 3 21:37:09 CDT 2003
if anyone can shed some light, i'd really appreciate it...
thanks again
redmond
--
FreeBSD 5.1-RELEASE-p10 FreeBSD 5.1-RELEASE-p10 #0: Fri Oct 3 21:30:51 CDT 2003
11:45AM up 5 days, 2:01, 2 users, load averages: 0.82, 0.51, 0.48
Oh, wow! Look at the moon!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031010/8826bf66/attachment.bin
More information about the freebsd-questions
mailing list