PDA

View Full Version : strange log entries.....

gballard
November 30th, 2004, 12:21 AM
In the auth.log:
Nov 29 10:33:29 localhost sshd[11284]: Did not receive identification string from ::ffff:21$
Nov 29 10:39:57 localhost sshd[11311]: Illegal user patrick from ::ffff:211.33.175.54
Nov 29 10:39:59 localhost sshd[11313]: Illegal user patrick from ::ffff:211.33.175.54

In the daemon.log:
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 29 11:17:04 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86

Someone doing a scan perhaps?
HungSquirrel
November 30th, 2004, 12:55 AM
Is your username patrick?
gballard
November 30th, 2004, 10:55 AM
Is your username patrick?
nope...no idea who patrick is...
jdong
November 30th, 2004, 11:37 AM
It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21)

Perhaps a faulty FTP client. Are you running a public FTP server?
gballard
December 3rd, 2004, 10:10 PM
It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21)

Perhaps a faulty FTP client. Are you running a public FTP server?
I am running an ftp server..yes...proftpd...
jdong
December 4th, 2004, 07:11 PM
Seems like a problem with faulty FTP clients. Don't worry about it, then!