ftp auth fails not recognized

[Derevko]

Hi,

it seems proftpd auth fails are not recognized. I've

LF_FTPD = "10"
LF_FTPD_PERM = "3600"

and ip are not blocked:

Code: Select all

ProFTPd [26007] 175.44.6.117 [14/mar/2014:18:57:58 +0100] "USER xxxxx" 331
ProFTPd [26007] 175.44.6.117 [14/mar/2014:18:57:58 +0100] "PASS (hidden)" 530
ProFTPd [26285] 175.44.6.117 [14/mar/2014:18:58:03 +0100] "USER admin" 331
ProFTPd [26285] 175.44.6.117 [14/mar/2014:18:58:03 +0100] "PASS (hidden)" 530
ProFTPd [26444] 175.44.6.117 [14/mar/2014:18:58:07 +0100] "USER xxxx" 331
ProFTPd [26444] 175.44.6.117 [14/mar/2014:18:58:08 +0100] "PASS (hidden)" 530
ProFTPd [26791] 175.44.6.117 [14/mar/2014:18:58:12 +0100] "USER administrator" 331
ProFTPd [26791] 175.44.6.117 [14/mar/2014:18:58:12 +0100] "PASS (hidden)" 530
ProFTPd [27862] 175.44.6.117 [14/mar/2014:18:58:17 +0100] "USER root" 331
ProFTPd [27862] 175.44.6.117 [14/mar/2014:18:58:17 +0100] "PASS (hidden)" 530

[ForumAdmin]

You would have to write a custom regex to catch this as it is not a format that csf detects, using /etc/csf/regex.custom.pm

[Derevko]

Hi,

thanks for your reply. I can do it, but note that I use standard Directadmin installation with proftpd 1.3.4d build from directadmin custombuild.