Re: [Proftpd-user] ftpdctl ban user is not permanent

On 2019-10-30 10:45, Matus UHLAR - fantomas wrote:
> On 29.10.19 14:07, David Mathog wrote:
>> This CentOS 7 system can ban ftp users by name with:
>> 
>>  ftpdctl ban user USERNAME
>> 
>> but it does not survive a stop/start cycle of proftpd.
> 
> http://www.proftpd.org/docs/contrib/mod_ban.html#FAQ
> 
> I believe this answers your question

It did, and then again it didn't.

I'm trying to reduce the number of script kiddie triggered log records.  
Those
intrusion attempts are not getting in but they represent the majority of 
the log records so they are an annoyance.  Our DNS name is "a.b.c", 
where a, b, and c are all strings whose content does not matter here, 
and those scripts try  each of them as user names  in various orders.  
However, there are no users a, b, or c, so that results in messages to 
/var/log/secure containing:

    User astring: no such user found from

With ban in place those attempts still took place (I assume) but the 
"secure" log file no longer filled up with notices about them.  When the 
ban was removed and this used instead:

   <Limit LOGIN>
     DenyUser astring
     DenyUser bstring
     DenyUser cstring
   </Limit>

the log file once again started accumulating these:

    User astring: no such user found from

What I'm looking for is a proftpd.conf configuration that will silently 
drop
connection attempts of this type.  Perhaps there is some directive to 
NOT log that one message?  Ideally it would also blacklist the site 
which sent it, at least temporarily.

Tony Stocker wrote:

> Do you use the 'fail2ban' package in CentOS 7?
I don't. In part because the system does not use firewalld, it uses 
instead a home grown script which generates a static iptables 
configuration stored in /etc/sysconfig/iptables which loads when the 
system boots.

So far I have not seen any evidence that the ftp attack scripts coincide 
with http or other attacks.

Thanks,

David Mathog
[email protected]
Manager, Sequence Analysis Facility, Biology Division, Caltech


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html