looks like attack on proftpd

V

vuliad

What is that? And how can I prevent this? (because it takes 99% memory and cpu)
Code: 
[root@thcdev /]# ps aux | grep prof
nobody         2372 16.4  0.1 15120  1920  ??  R     7:39AM  51:51.34 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:34712) (proftpd)
nobody         2351 16.3  0.1 15120  1904  ??  R     7:39AM  58:45.17 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:48784) (proftpd)
nobody         2369 14.3  0.1 15120  1916  ??  R     7:39AM  48:06.88 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:32821) (proftpd)
nobody         2374 13.8  0.1 15120  1920  ??  R     7:39AM  59:31.00 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:35917) (proftpd)
nobody         2358 10.5  0.1 15120  1904  ??  R     7:39AM  55:34.14 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:54228) (proftpd)
nobody         2367 10.5  0.1 15120  1916  ??  R     7:39AM  49:26.20 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:59875) (proftpd)
nobody         2361  9.6  0.1 15120  1912  ??  R     7:39AM  51:23.69 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:56081) (proftpd)
nobody         2378  9.3  0.1 15120  1924  ??  R     7:39AM  55:19.58 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:38187) (proftpd)
nobody         2379  8.9  0.1 15120  1924  ??  R     7:39AM  49:32.94 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:38843) (proftpd)
nobody         2355  8.8  0.1 15120  1904  ??  R     7:39AM  54:03.00 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:52244) (proftpd)
nobody         2356  8.8  0.1 15120  1904  ??  R     7:39AM  62:46.75 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:53026) (proftpd)
nobody         2371  8.8  0.1 15120  1916  ??  R     7:39AM  52:06.58 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:34078) (proftpd)
nobody         2373  8.8  0.1 15120  1920  ??  R     7:39AM  48:44.15 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:35310) (proftpd)
nobody         2375  8.8  0.1 15120  1920  ??  R     7:39AM  47:29.77 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:36461) (proftpd)
nobody         2376  8.8  0.1 15120  1920  ??  R     7:39AM  50:12.19 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:37046) (proftpd)
nobody         2357  8.7  0.1 15120  1904  ??  R     7:39AM  49:04.40 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:53658) (proftpd)
nobody         2359  8.4  0.1 15120  1904  ??  R     7:39AM  55:35.86 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:54819) (proftpd)
nobody         2366  8.3  0.1 15120  1912  ??  R     7:39AM  55:31.77 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:59302) (proftpd)
nobody         2353  8.2  0.1 15120  1904  ??  R     7:39AM  56:02.89 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:51086) (proftpd)
nobody         2363  8.1  0.1 15120  1912  ??  R     7:39AM  47:09.37 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:57415) (proftpd)
nobody         2352  8.0  0.1 15120  1904  ??  R     7:39AM  47:54.90 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:50555) (proftpd)
nobody         2364  8.0  0.1 15120  1912  ??  R     7:39AM  48:43.52 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:58066) (proftpd)
nobody         2380  8.0  0.1 15120  1924  ??  R     7:39AM  53:13.72 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:39833) (proftpd)
nobody         2360  7.8  0.1 15120  1904  ??  R     7:39AM  49:27.06 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:55438) (proftpd)
nobody         2365  7.3  0.1 15120  1912  ??  R     7:39AM  52:14.95 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:58623) (proftpd)
nobody         2370  7.2  0.1 15120  1916  ??  R     7:39AM  59:37.45 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:33462) (proftpd)
nobody         2362  7.1  0.1 15120  1912  ??  R     7:39AM  48:46.21 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:56809) (proftpd)
nobody         2377  7.1  0.1 15120  1924  ??  R     7:39AM  49:05.52 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:37583) (proftpd)
nobody         2354  7.0  0.1 15120  1904  ??  R     7:39AM  56:53.85 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:51620) (proftpd)
nobody         2368  7.0  0.1 15120  1916  ??  R     7:39AM  62:35.67 proftpd: connected: sd-19556.dedibox.fr (88.190.12.92:60481) (proftpd)
after I set maxclients per host to 5 and reject this host.
 
Looks like a typical bruteforce to me. Fact of life these days.

I suggest installing something like security/sshguard. Despite of what the name might imply it can also protect ProFTP.
 
You must log in or register to reply here.
Back
Top