Latest FTP attack...

Purdy on 2002-02-04T14:15:40

As I'm also a sysadmin (scary thought...), I constantly watch our logs ... here's the latest hack attempt:

Feb 3 07:25:18 www proftpd[27289]: {our ip address} (193.251.169.174[193.251.169.174]) - FTP session opened.
Feb 3 07:26:59 www PAM_pwdb[27289]: get passwd; pwdb: request not recognized
Feb 3 07:27:00 www proftpd[27289]: {our ip address} (193.251.169.174[193.251.169.174]) - PAM(ftp): Authentication service cannot retrieve authentication info..
Feb 3 07:27:39 www proftpd[27289]: {our ip address} (193.251.169.174[193.251.169.174]) - FTP session closed.

I really need to shutdown FTP ... thankfully, I don't have anonymous ftp setup - that would be even worse. Just need to figure out how to get the graphics folks, who use Macs, a secure (and easy) way to transfer files...

Jason

Update: You know, I was thinking this yesterday (maybe Saturday) as a reference point/analogy ... a hacker obtaining root access is like a chess opponent getting their rook into your back corner ... NOT good.


Secure. (Easy?)

jdavidb on 2002-02-05T16:12:47

NiftyTelnet for Mac will let you do scp. It works for a techie like me; not sure how easy other folks would find it.

Re:Secure. (Easy?)

Purdy on 2002-02-12T13:35:02

I tried that, but couldn't find the Authentication Manager module that plugs into NiftyTelnet... may look into DreamWeaver's CVS plug-in.