pureftpd - auth.log records with empty rhost

Discussion in 'Server Operation' started by shr3k, Jun 14, 2012.

  1. shr3k

    shr3k New Member

    Hi all, have you anyone found also following similar strange records in your Debian-based system auth.log as well?:

    Code:
    Jun 14 08:17:41 swamp pure-ftpd: pam_unix(pure-ftpd:auth): check pass; user unknown
    Jun 14 08:17:41 swamp pure-ftpd: pam_unix(pure-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=skvpraha rhost=
    Jun 14 08:17:41 swamp pure-ftpd: pam_unix(pure-ftpd:auth): check pass; user unknown
    Jun 14 08:17:41 swamp pure-ftpd: pam_unix(pure-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=skvpraha rhost=
    Jun 14 08:17:54 swamp pure-ftpd: pam_unix(pure-ftpd:auth): check pass; user unknown
    Jun 14 08:17:54 swamp pure-ftpd: pam_unix(pure-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=skvprahaskvpraha rhost=
    Jun 14 08:17:57 swamp pure-ftpd: pam_unix(pure-ftpd:auth): check pass; user unknown
    Jun 14 08:17:57 swamp pure-ftpd: pam_unix(pure-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=skvprahaskvpraha rhost=
    I wonder how it is possible that pureftpd does not detect remote host. My fail2ban can't subsequently block it because is missing rhost... :confused:

    And /etc/pure-ftpd/conf/DontResolve is set to yes of course.
     
    Last edited: Jun 14, 2012
  2. falko

    falko Super Moderator ISPConfig Developer

    Have you tried no instead?
     
  3. shr3k

    shr3k New Member

    Yes I tried, but it was unnecessary at all, daemon get's called by /usr/sbin/pure-ftpd-wrapper script, where's clearly stated 'DontResolve' => ['-H'], line. I tried manually launch as well with --dontresolve but no luck, seems to be bug in this Ubuntu 11.10 build.
     

Share This Page