Is someone trying to hack my FTP server?

Hello!
Recently, I discover that my server logged some strange records.
I had not seen logs like them before.
Is someone trying to hack my FTP server?
I am using RH9 with vsftp.
Thanks in advance!

----------------------------------------------------------------------------
-----------------------------------

Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3942]: check pass; user unknown
Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3942]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=217.42.173.x
Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3944]: check pass; user unknown
Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3944]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=217.42.173.x
Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3946]: check pass; user unknown
Apr 22 08:58:55 campusradio vsftpd(pam_unix)[3946]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=217.42.173.x
Apr 22 08:58:56 campusradio vsftpd(pam_unix)[3948]: check pass; user unknown
Apr 22 08:58:56 campusradio vsftpd(pam_unix)[3948]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=217.42.173.x
Apr 22 08:58:56 campusradio vsftpd: warning: can't get client address: Bad
file descriptor
Apr 22 08:58:56 campusradio last message repeated 2 times
Apr 22 08:58:57 campusradio vsftpd(pam_unix)[3950]: check pass; user unknown
Apr 22 08:58:57 campusradio vsftpd(pam_unix)[3950]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=217.42.173.x
Apr 22 08:58:57 campusradio vsftpd: warning: can't get client address: Bad
file descriptor
Apr 22 08:58:57 campusradio vsftpd: warning: can't get client address: Bad
file descriptor
Apr 22 08:58:57 campusradio vsftpd(pam_unix)[3954]: check pass; user unknown


~ Let us linux ~


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

On 22 Apr 2004 10:53:37 +0800, Fool wrote:
> Hello!
> Recently, I discover that my server logged some strange records.
> I had not seen logs like them before.
> Is someone trying to hack my FTP server?

Could be a simple port scan. Does this happen over a longer period of
time?

Cheers,
Ingo

--
Ingo Strauch ---- Registered Linux User #227900 (http://counter.li.org/)
http://www.the-one-brack.org/

"Ingo Strauch" <strauch@mail.desy.de> ¼¶¼g©ó¶l¥ó
news:slrnc8f5k6.2m3.strauch@togo.desy.de...
> On 22 Apr 2004 10:53:37 +0800, Fool wrote:
> > Hello!
> > Recently, I discover that my server logged some strange records.
> > I had not seen logs like them before.
> > Is someone trying to hack my FTP server?
>
> Could be a simple port scan. Does this happen over a longer period of
> time?
>
> Cheers,
> Ingo
>
> --
> Ingo Strauch ---- Registered Linux User #227900 (http://counter.li.org/)
> http://www.the-one-brack.org/

Yes, it always happen. But it come from many hosts.
For each source host, it happens over a short period of time only.

Thanks!



~ Let us linux ~


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----