PDA

View Full Version : strange log entries.....

gballard
November 29th, 2004, 11:21 PM
In the auth.log:
Nov 29 10:33:29 localhost sshd[11284]: Did not receive identification string from ::ffff:21$
Nov 29 10:39:57 localhost sshd[11311]: Illegal user patrick from ::ffff:211.33.175.54
Nov 29 10:39:59 localhost sshd[11313]: Illegal user patrick from ::ffff:211.33.175.54

In the daemon.log:
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 29 11:17:04 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86

Someone doing a scan perhaps?
HungSquirrel
November 29th, 2004, 11:55 PM
Is your username patrick?
gballard
November 30th, 2004, 09:55 AM
Is your username patrick?
nope...no idea who patrick is...
jdong
November 30th, 2004, 10:37 AM
It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21)

Perhaps a faulty FTP client. Are you running a public FTP server?
gballard
December 3rd, 2004, 09:10 PM
It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21)

Perhaps a faulty FTP client. Are you running a public FTP server?
I am running an ftp server..yes...proftpd...
jdong
December 4th, 2004, 06:11 PM
Seems like a problem with faulty FTP clients. Don't worry about it, then!