[CLUE-Tech] vsftpd question

[Angelo Bertolli]

Charles Oriez wrote:

> At 09:21 AM 6/15/2004 -0400, Angelo Bertolli wrote:
>
>
>>> didn't work. between 2045 and 2322 last night, 24.122.3.138 tried to 
>>> connect 3441 times.
>>
>> Can you just block the IPs for that address block for the time being?
>> (Is there a legitimate ftp user in Canada?)
>
>
> except he uses different IPAs every day
>
You can block these address blocks.  But I think your tarpit idea is the 
best one if you can get it working.  I'm not sure if you can tell if 
they're trying to authenticate themselves or not, but it looks like they 
aren't.  If you think these are all the same person or group (some are 
from Atlanta, some are from Canada, some are from Spain, some are from 
elsewhere in Europe), why do you think they are targetting your server?  
I never get this sort of thing using wu-ftpd.

Angelo