weird ftp-related logcheck msgs

Redmond Militante r-militante at northwestern.edu
Fri Oct 10 10:12:22 PDT 2003


hi all

the last couple of days, i've noticed strange security notifications sent to the root user of one of my boxen.  this box is running proftpd as an ftp server.  the messages appear whenever somebody authenticates via ftp.  most often, it's me ftp'ing to the machine, so it's probably not someone doing something malicious (just in case, i ran chkrootkit and yafic, which turn up clean...)

the messages look like

Oct 10 11:27:06 server proftpd[45750]: server.com
+(my.box.com[129.xxx.xx.xx]) - PAM(secure): Permission denied.
Oct 10 11:17:25 server sendmail[45703]: h9AGHPbK045703: h9AGHPbL045703: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:17:41 server sendmail[45708]: h9AGHfPB045708: h9AGHfPC045708: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:18:43 server sendmail[45715]: h9AGIhBK045715: h9AGIhBL045715: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:13 server sendmail[45720]: h9AGJDEV045720: h9AGJDEW045720: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:29 server sendmail[45725]: h9AGJTMA045725: h9AGJTMB045725: DSN: To:... List:;
+syntax illegal for recipient addresses
Oct 10 11:19:56 server sendmail[45730]: h9AGJuBg045730: h9AGJuBh045730: DSN: To:... List:;
+syntax illegal for recipient addresses


i'm not sure what to make of these messages.  ftp still seems to work (fyi - i upgraded to the latest version of proftpd today - 1.2.8 stable, didn't fix the situation though), my server is 

FreeBSD server.com 4.7-RELEASE-p23 FreeBSD 4.7-RELEASE-p23 #0: Fri Oct  3 21:37:09 CDT 2003

if anyone can shed some light, i'd really appreciate it...

thanks again

redmond

-- 
FreeBSD 5.1-RELEASE-p10 FreeBSD 5.1-RELEASE-p10 #0: Fri Oct 3 21:30:51 CDT 2003
11:45AM  up 5 days,  2:01, 2 users, load averages: 0.82, 0.51, 0.48
 
Oh, wow!  Look at the moon!
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031010/8826bf66/attachment.bin


More information about the freebsd-questions mailing list