So..
auth.log:
Code:
Jun 18 17:23:01 vadmin112 sshd[15977]: Invalid user rooms from 211.115.234.143
Jun 18 17:23:01 vadmin112 sshd[15981]: pam_unix(sshd:auth): check pass; user unknown
Jun 18 17:23:01 vadmin112 sshd[15981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.115.234.143
Jun 18 17:23:03 vadmin112 sshd[15979]: Accepted keyboard-interactive/pam for root from 91.57.39.203 port 53791 ssh2
Jun 18 17:23:03 vadmin112 sshd[15979]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jun 18 17:23:03 vadmin112 sshd[15983]: lastlog_filetype: Couldn't stat /var/log/lastlog: No such file or directory
Jun 18 17:23:03 vadmin112 sshd[15983]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Jun 18 17:23:03 vadmin112 sshd[15983]: lastlog_filetype: Couldn't stat /var/log/lastlog: No such file or directory
Jun 18 17:23:03 vadmin112 sshd[15983]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Jun 18 17:23:03 vadmin112 sshd[15977]: error: PAM: User not known to the underlying authentication module for illegal user rooms from 211.115.234.143
Jun 18 17:23:03 vadmin112 sshd[15977]: Failed keyboard-interactive/pam for invalid user rooms from 211.115.234.143 port 44696 ssh2
und im deamon.log steht nichts nach dem proftpd restart.
könnt ihr damit was anfangen ?
edit:
proftpd.log
Quote:Jun 16 17:53:52 vadmin112 proftpd[2490] vadmin112: ProFTPD 1.3.1 standalone mode SHUTDOWN
Jun 16 17:53:54 vadmin112 proftpd[6968] vadmin112: ProFTPD 1.3.1 (stable) (built Fri Feb 27 21:34:04 UTC 2009) standalone mode STARTUP
Jun 16 17:55:17 vadmin112 proftpd[7152] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session opened.
Jun 16 17:55:17 vadmin112 proftpd[7152] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): no such user 'admin'
Jun 16 17:55:17 vadmin112 proftpd[7152] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): USER admin: no such user found from p5B392B39.dip.t-dialin.net [::ffff:91.57.43.57] to ::ffff:84.200.12.227:21
Jun 16 17:55:17 vadmin112 proftpd[7152] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session closed.
Jun 16 17:55:25 vadmin112 proftpd[7153] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session opened.
Jun 16 17:55:25 vadmin112 proftpd[7153] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): no such user 'admin'
Jun 16 17:55:25 vadmin112 proftpd[7153] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): USER admin: no such user found from p5B392B39.dip.t-dialin.net [::ffff:91.57.43.57] to ::ffff:84.200.12.227:21
Jun 16 17:55:25 vadmin112 proftpd[7153] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session closed.
Jun 16 17:56:12 vadmin112 proftpd[7154] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session opened.
Jun 16 17:56:12 vadmin112 proftpd[7154] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): no such user 'admin@web1x.wth-sponsoring.de'
Jun 16 17:56:12 vadmin112 proftpd[7154] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): USER admin@web1x.wth-sponsoring.de: no such user found from p5B392B39.dip.t-dialin.net [::ffff:91.57.43.57] to ::ffff:84.200.12.227:21
Jun 16 17:56:12 vadmin112 proftpd[7154] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session closed.
Jun 16 17:57:55 vadmin112 proftpd[7162] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session opened.
Jun 16 17:57:55 vadmin112 proftpd[7162] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): no such user 'anonymous'
Jun 16 17:57:55 vadmin112 proftpd[7162] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): USER anonymous: no such user found from p5B392B39.dip.t-dialin.net [::ffff:91.57.43.57] to ::ffff:84.200.12.227:21
Jun 16 17:57:55 vadmin112 proftpd[7162] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session closed.
Jun 16 17:57:55 vadmin112 proftpd[7163] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session opened.
Jun 16 17:57:59 vadmin112 proftpd[7163] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): no such user 'admin'
Jun 16 17:57:59 vadmin112 proftpd[7163] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): USER admin: no such user found from p5B392B39.dip.t-dialin.net [::ffff:91.57.43.57] to ::ffff:84.200.12.227:21
Jun 16 17:58:01 vadmin112 proftpd[7163] vadmin112 (p5B392B39.dip.t-dialin.net[::ffff:91.57.43.57]): FTP session closed.