Can proftpd be supported?
Posted: 20 Jan 2007, 20:45
Is it possible for proftpd to be supported for lfd monitoring and blocking?
Peer support forums for ConfigServer Scripts
https://mail.forum.configserver.com/
Thanks. If you need any bad login strings for it, just let me know.chirpy wrote:You can add it yourself if you under stand perl regex handling in /etc/csf/regex.pm, otherwise i'll put it on the wishlist.
Code: Select all
Jan 22 09:29:14 blue proftpd[13139]: blue.servername.com (se2-scan01.scanalert.com[209.67.114.32]) - USER bogusbogus: no such user found from se2-scan01.scanalert.com [209.67.114.32] to 69.94.108.88:21
Jan 22 09:29:39 blue proftpd[13186]: blue.servername.com (se2-scan01.scanalert.com[209.67.114.32]) - USER nobody (Login failed): Incorrect password.Code: Select all
FTPD_LOG = "/var/log/proftpd/proftpd_system.log"Code: Select all
Dec 09 13:17:58 server1.theserver.org proftpd[30058] server1.theserver.org (vps.thehacker.net[123.456.789.012]): PAM(username): Authentication failure.Code: Select all
#proftpd
if (($config{LF_FTPD}) and ($lgfile eq $config{FTPD_LOG}) and ($bits[4] =~ /^proftpd/) and ($line =~ /*.no such user.*/) and ($bits[6] =~ /(\d+\.\d+\.\d+\.\d+)/)) {
return ("Failed FTP login from",$1,"ftpd");
}
if (($config{LF_FTPD}) and ($lgfile eq $config{FTPD_LOG}) and ($bits[4] =~ /^proftpd/) and ($line =~ /*.Authentication failure.*/) and ($bits[6] =~ /(\d+\.\d+\.\d+\.\d+)/)) {
return ("Failed FTP login from",$1,"ftpd");
}