FTP "OTHER Root" Logs

[Craig White]

-----Original Message-----
From: plug-discuss-admin@lists.plug.phoenix.az.us
[mailto:plug-discuss-admin@lists.plug.phoenix.az.us]On Behalf Of Tyler Hall
Sent: Tuesday, February 06, 2001 9:39 PM
To: plug-discuss@lists.plug.phoenix.az.us
Subject: FTP "OTHER Root" Logs


Seems I'm a little concered -- This is what shows up in my /var/log/secure
file

Apr  3 21:33:20 gizmo xinetd[568]: START: ftp pid=17050 from=206.212.47.168
Apr  3 21:33:21 gizmo xinetd[17050]: USERID: ftp OTHER :root

Does that mean, someone "attemped to ftp as userid root and failed... or he
attempted and suceeded?"  I dont think you can FTP as root, but it looks
like he did..

--------

Tyler - more people will read and most will appreciate it if you post in
plain text mode instead of html mode.

Type "last" at the command prompt to get a list of successful logins. Type
"lastb" to get a list of unsuccessful logins. If lastb fails, then 'touch
/var/log/btmp' and it will start recording unsuccessful logins.

Craig