Secury problems Proftpd ISPConfig

Discussion in 'General' started by Captain, Mar 23, 2009.

  1. Captain

    Captain Member


    I think that my server is attacked or have something wrong.
    I can't find a problem.
    I have hosting server for some web pages.
    In proftpd log files I see that one client have many failed connections.
    Mar 16 03:43:44 proftpd[14151] ([]): FTP session opened.
    Mar 16 03:43:46 proftpd[14151] ([]): USER sample_user (Login failed): Incorrect password.
    Mar 16 03:43:47 proftpd[14151] ([]): FTP session closed.
    Mar 16 03:55:35 proftpd[14319] ([]): FTP session opened.
    Mar 16 03:55:38 proftpd[14319] ([]): USER sample_user (Login failed): Incorrect password.
    Mar 16 03:55:38 proftpd[14319] ([]): FTP session closed.
    This local IP is a this hosting server local IP.
    I see this failture message approx. every 5-10 min.

    What is it? It is attack? And how I can to resolv this problem!

    Big thanks!
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    This is normal on a hosted enviroment, hosting servers get attacked all the time by bots. If you want to protect your server you can use e.g. fail2ban. There are tutorials for fail2ban here on howtoforge.

Share This Page