Jeff, I'm seeing some activity on our server that I don't understand. The "last" command shows a fair bit of activity by user ftp from various ip addresses. Both the ftp account and services have been disabled. So, I don't understand why there would be any ftp user activity. Does it make sense to you or anyone else on the list? Lynn