Home › Forums › BlockHosts

PureFTPd attack not recognized

Wed, 2007–Jul–25

Hi,

I'm not an expert about hosts.allow & python.
Someone try to break my Ubuntu Feisty box.

/var/log/syslog
[snip]
Jul 25 22:52:40 blue pure-ftpd: (?@server.r20hosting.com) [INFO] New connection from server.r20hosting.com
Jul 25 22:52:40 blue pure-ftpd: (?@server.r20hosting.com) [INFO] PAM_RHOST enabled. Getting the peer address
Jul 25 22:52:41 blue pure-ftpd: (?@server.r20hosting.com) [WARNING] Authentication failed for user [Administrator]
Jul 25 22:52:42 blue pure-ftpd: (?@server.r20hosting.com) [WARNING] Authentication failed for user [Administrator]
Jul 25 22:52:43 blue pure-ftpd: (?@server.r20hosting.com) [INFO] PAM_RHOST enabled. Getting the peer address
Jul 25 22:52:44 blue pure-ftpd: (?@server.r20hosting.com) [INFO] PAM_RHOST enabled. Getting the peer address
Jul 25 22:52:45 blue pure-ftpd: (?@server.r20hosting.com) [INFO] PAM_RHOST enabled. Getting the peer address
[/snip]

It's not recognized because of the name in place of an IP. How can I correct this?

Thx,

Damien

‹ blockhosts with Solaris 10 Help with Postfix rule, PLEASE ›
Wed, 2007-07-25 20:50 — ac

use the pure-ftpd -H option

blockhosts cannot work with fully qualified names - it needs IP addresses.

Looking at the pure-ftpd documention, it shows this:

-H  --dontresolve  
'-H': By default, fully-qualified host names are logged. To achieve this,
DNS lookups are mandatory. The '-H' flag avoids host names resolution.

So, unless you can run pure-ftpd with the -H or --dontresolve option, blockhosts cannot do its work.