Logwatch error or possible crack attempt?
Jeff Vian
jvian10 at charter.net
Sun Sep 26 01:03:23 UTC 2004
On Sat, 2004-09-25 at 14:51, Lorn Miller wrote:
> Logwatch for Sep 22
> --------------------- pam_unix Begin ------------------------
>
> <cut>
>
> vsftpd:
> Unknown Entries:
> authentication failure; logname= uid=0 euid=0 tty= ruser=
> rhost=80.141.233.183 : 16 Time(s)
> check pass; user unknown: 16 Time(s)
>
>
> ---------------------- pam_unix End -------------------------
>
This is an attempt to connect to ftp from 80.141.233.183 and says that
the connection failed because of username/password problems.
If this is not your machine, then someone else is trying to connect.
Check /var/log/vsftpd.log for entries related to this IP.
>
> Is there a local process that would do that or did someone try to get
> into my ftp server 16 times? Where could I check to see if they
> succeeded?
>
More information about the users
mailing list