strange log entries.....

[gballard]

In the auth.log:
Nov 29 10:33:29 localhost sshd[11284]: Did not receive identification string from ::ffff:21$
Nov 29 10:39:57 localhost sshd[11311]: Illegal user patrick from ::ffff:211.33.175.54
Nov 29 10:39:59 localhost sshd[11313]: Illegal user patrick from ::ffff:211.33.175.54

In the daemon.log:
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 28 18:27:53 localhost proftpd[6804]: localhost.localdomain (213.149.238.3[213.149.238.3
Nov 29 11:17:04 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86
Nov 29 11:28:14 localhost proftpd[11542]: localhost.localdomain (208.62.217.86[208.62.217.86

Someone doing a scan perhaps?

[HungSquirrel]

Is your username patrick?

[gballard]

Originally Posted by HungSquirrel Is your username patrick?

nope...no idea who patrick is...

[jdong]

It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21)

Perhaps a faulty FTP client. Are you running a public FTP server?

[gballard]

Originally Posted by jdong It seems like somehow sshd is getting some FTP traffic -- perhaps a port number confusion (22 vs 21) Perhaps a faulty FTP client. Are you running a public FTP server?

I am running an ftp server..yes...proftpd...

[jdong]

Seems like a problem with faulty FTP clients. Don't worry about it, then!