Home › Forums › BlockHosts

proftp login attempts not being caught

Fri, 2007–Jan–12

I've gotten blockhosts to work with ssh, it gets most things, but when trying to get it to work with proftpd, it bombs. I can't seem to get it to catch bad login attempts or failed passwords. I have gotten it to invoke through inetd, it runs, seems to load the logfile, but it don't catch the bad attempts.

TIA

Jason

‹ delay when connecting to ssh from *some* hosts. made blockhost for apache and horde webmail ›
Mon, 2007-03-05 17:01 — Jerome (not verified)

double-check your logfile

Could you print here a bad-login line from your proftpd log? It could be that it's not matching a ":" character, I just had this problem... It's either ProFTPd 1.3.0-19 or the fact that I used syslog-ng... In any case you could try these regex, they worked for me :

    "ProFTPD-NoPassword": r"""proftpd\[(?P<pid>\d+)\] [^[]+\[(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+Login failed""",

    "ProFTPD-NoUser": r"""proftpd\[(?P<pid>\d+)\] [^[]+\[(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+no such user""",

    "ProFTPD-SecurityViolation": r"""proftpd\[(?P<pid>\d+)\] [^[]+\[(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+SECURITY VIOLATION""",

(Those have to be on one line only in the config file)

Editor: added pre/pre tags around regex, and changed < to &lt; to make it show up.