Hi I used ISPconfig auto script to install the ubuntu 18.04 perfect server. it has pure-FTP installed by default. after a few days I installed the server, I found something suspicious from syslog below showing that someone successfully connected to my server, then logout. syslog: Nov 25 06:30:17 sev1 pure-ftpd: ([email protected]) [INFO] New connection from 126.96.36.199 Nov 25 06:30:18 sev1 pure-ftpd: ([email protected]) [INFO] Logout. I did not create any FTP account (ISPconfig FTP account page empty), and I enabled SSH with key for root. I also tried to root can not login FTP with port 21. I really don't understand how it is possible someone can hack my new server to login as FTP as the log shows.