1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Strange FTP connections

Discussion in 'Plesk for Linux - 8.x and Older' started by 19media, Dec 7, 2006.

  1. 19media

    19media Guest

    I'd really appreciate the knowledge and help of some slightly more experienced linux users...

    Logwatch is showing a large number of attempted FTP logins to a particular domain on our server from a wide range of IPs from all over the world. The attempted logins are all to the same username (which was until recently a valid username).

    We changed the ftp usernames and passwords on the server before backing-up and reimaging, so the logs only go back a couple of days.

    We keep the FTP ports closed on a hardware firewall, but whenever any of the three (valid) users open the port to upload or download, the secure log fills up with attempted FTP connections from IPs all over the place.

    What sort of things should I be looking at to trace the root of this problem?