RE: wu-ftpd attack???

From: Bojan Zdrnja (Bojan.Zdrnja@FER.hr)
Date: 11/27/02

  • Next message: Randy Millis: "Bad protocol version identification '^V^C^A'" 
    From: "Bojan Zdrnja" <Bojan.Zdrnja@FER.hr>
To: "'M. den Braber'" <maurice@office.igr.nl>, <incidents@securityfocus.com>
Date: Wed, 27 Nov 2002 11:42:17 +0100

    I get loads of similar connections every day. I suppose it's some (very
    simple) automated tool to check various servers if they accept anonymous
    connections (probably used by warez kids who then upload their warez into
    server and use it as distribution site).

    In your case, connections from remote client are too excessive - maybe
    automated tool isn't properly configured.

    Default setting in tcp wrappers (which you obviously use to start proftpd)
    allows maximum of 40 spawned sessions of one service in 60 seconds. In your
    case, it goes over this maximum number, so inetd terminates proftpd service.

    If you don't use anonymous ftp (and you said you don't), you can put some
    restrictions on allowed IPs which connect to your ftp server (of course, if
    that's possible).

    In other case, you can put higher value on allowed maximum number of spawned
    connections in /etc/inetd.conf file.

    Just find line with proftpd, it should look like:

    ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/proftpd

    and change nowait parameter to something like nowait.400
    This will allow 400 spawned connections in 60 seconds.

    Best regards,

    Bojan Zdrnja

    > -----Original Message-----
    > From: M. den Braber [mailto:maurice@office.igr.nl]
    > Sent: 26. studeni 2002 10:05
    > To: incidents@securityfocus.com
    > Subject: RE: wu-ftpd attack???
    >
    >
    > I just posted this in focus-linux a minute ago, looks the same:
    >
    > >Hi guys,
    > >
    > >I'm fairly new to the lists so i hope i'm dropping it
    > >in the right one. ;-)
    > >
    > >Anyway,
    > >
    > >In my network there is a cobalt raq4 that is hosting several
    > >sites and today i noticed that in the last couple of days the
    > >number of connections shot through the roof. (Compared to usual ;) )
    > >
    > >When i take a look at the logs i noticed that someone
    > >is trying to login using an anonymous ftp account, which is,
    > >off course disabled.
    > >
    > >[log]
    > >Nov 25 10:37:53 koushaven proftpd[8479]: - FTP session opened.
    >

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Re: SBS 2003 IIS BASED SERVICES FAIL INTERMITTENTLY
      ... If I read your post correctly, you have a switch where the SBS ... Run DHCP server on your SBS, and set all client machine nics to dynamic. ... Once you have your nics configured, run the Connect to the Internet wizard, ... QUESTION1 - what is REFUSING CONNECTIONS? ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS Exchange 2003: too many "Current Sessions" opened
      ... So far everything is good and now I'm just monitoring my exchange. ... get the SMTP service to stop hanging in the first place. ... won't have dead connections. ... work for now until I put into production new server hardware with sbs 2003 ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS Exchange 2003: too many "Current Sessions" opened
      ... You really should go through the steps I posted and get the SMTP service to stop hanging in the first place. ... You'll be happier, you won't be clubbing your server every day with a kill script, and you won't have dead connections. ... You do *not* need to restart the server, ...
      (microsoft.public.windows.server.sbs)
    • Access 2007->SQL Server2005 "connection was forcibly closed",GNE 1
      ... I have a very big problem connecting an SQL ... changing number of clients using the SQL Server with this frontend at the ... connection pooling or if these connections are separated connections). ...
      (microsoft.public.sqlserver.connect)
    • Re: Reducing load for LAMP app?
      ... MySQL: as much as possible, he keeps query results in RAM, but ... His hoster says that Apache server is under significant load. ... Using apc is pretty much transparent, but memcached will require modifying your database abstraction layer using the memcached functions. ... With persistent connections, you must have the maximum number of connections *ever* required allocated *all of the time* - even if no one is using your server. ...
      (comp.lang.php)