<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Sorry for the delay...<div><br></div><div><br><div><div>On 15 Jul 2014, at 8:06 pm, Colin Jack <<a href="mailto:colin@mainline.co.uk">colin@mainline.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi Greg <br><br>Any thoughts?<br><br></blockquote><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">type=Single</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">ptype=RegExp</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">pattern=^\S+\s+\d+\s+\S+\s+(\S+)\s+proftpd\[\S+\]: \S+ \(\S+\[(\S+)\]\) - \S+ \S+ \(Login failed\): Incorrect password.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">desc=$0</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">action=event BLOCK, $2, proftpd-b4</div><div><br></div><div>This is the rule that is getting matched. Basically, its a FTP incorrect password in /var/log/secure .... Find out whats doing the FTP jobs with the bad password, and problem fixed :)</div><div><br></div><div>Greg.</div></div><br><blockquote type="cite">Thanks<br><br>Colin<br><br><blockquote type="cite">On 11 Jul 2014, at 10:17, "Colin Jack" <<a href="mailto:colin@mainline.co.uk">colin@mainline.co.uk</a>> wrote:<br><br>Hi Greg,<br><br><blockquote type="cite">Check out /var/log/sec ... this is the log file for dfix2. Look for the IP in that file<br>and send me details of what you find. That will help to understand why a<br>particular IP is getting blocked.<br></blockquote><br>Well here is a result (sort of) ... I've been blocked this morning and I haven't been near it! :)<br><br>[root@server8 log]# cat sec |grep 84.23.16.59<br>Mon Jul 7 08:59:05 2014: Creating event 'BLOCK, 84.23.16.59, proftpd-b4'<br>Mon Jul 7 08:59:05 2014: BLOCK, 84.23.16.59, proftpd-b4<br>Mon Jul 7 08:59:05 2014: Executing shell command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Mon Jul 7 08:59:05 2014: Child 5201 created for command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Mon Jul 7 08:59:05 2014: Creating context 'BLOCK_84.23.16.59'<br>Mon Jul 7 09:59:06 2014: Deleting stale context 'BLOCK_84.23.16.59'<br>Mon Jul 7 09:59:06 2014: Creating event 'UNBLOCK, 84.23.16.59'<br>Mon Jul 7 09:59:06 2014: Stale context 'BLOCK_84.23.16.59' deleted<br>Mon Jul 7 09:59:06 2014: Executing shell command '/etc/apf/apf -u 84.23.16.59'<br>Mon Jul 7 09:59:06 2014: Child 9279 created for command '/etc/apf/apf -u 84.23.16.59'<br>Tue Jul 8 08:46:01 2014: Creating event 'BLOCK, 84.23.16.59, proftpd-b4'<br>Tue Jul 8 08:46:01 2014: BLOCK, 84.23.16.59, proftpd-b4<br>Tue Jul 8 08:46:01 2014: Executing shell command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Tue Jul 8 08:46:01 2014: Child 13833 created for command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Tue Jul 8 08:46:01 2014: Creating context 'BLOCK_84.23.16.59'<br>Tue Jul 8 09:46:02 2014: Deleting stale context 'BLOCK_84.23.16.59'<br>Tue Jul 8 09:46:02 2014: Creating event 'UNBLOCK, 84.23.16.59'<br>Tue Jul 8 09:46:02 2014: Stale context 'BLOCK_84.23.16.59' deleted<br>Tue Jul 8 09:46:02 2014: Executing shell command '/etc/apf/apf -u 84.23.16.59'<br>Tue Jul 8 09:46:02 2014: Child 16611 created for command '/etc/apf/apf -u 84.23.16.59'<br>Wed Jul 9 10:17:09 2014: Creating event 'BLOCK, 84.23.16.59, proftpd-b4'<br>Wed Jul 9 10:17:09 2014: BLOCK, 84.23.16.59, proftpd-b4<br>Wed Jul 9 10:17:09 2014: Executing shell command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Wed Jul 9 10:17:09 2014: Child 21518 created for command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Wed Jul 9 10:17:09 2014: Creating context 'BLOCK_84.23.16.59'<br>Wed Jul 9 11:17:10 2014: Deleting stale context 'BLOCK_84.23.16.59'<br>Wed Jul 9 11:17:10 2014: Creating event 'UNBLOCK, 84.23.16.59'<br>Wed Jul 9 11:17:10 2014: Stale context 'BLOCK_84.23.16.59' deleted<br>Wed Jul 9 11:17:10 2014: Executing shell command '/etc/apf/apf -u 84.23.16.59'<br>Wed Jul 9 11:17:10 2014: Child 24716 created for command '/etc/apf/apf -u 84.23.16.59'<br>Thu Jul 10 09:46:47 2014: Creating event 'BLOCK, 84.23.16.59, proftpd-b4'<br>Thu Jul 10 09:46:47 2014: BLOCK, 84.23.16.59, proftpd-b4<br>Thu Jul 10 09:46:47 2014: Executing shell command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Thu Jul 10 09:46:47 2014: Child 11206 created for command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Thu Jul 10 09:46:47 2014: Creating context 'BLOCK_84.23.16.59'<br>Thu Jul 10 10:46:48 2014: Deleting stale context 'BLOCK_84.23.16.59'<br>Thu Jul 10 10:46:48 2014: Creating event 'UNBLOCK, 84.23.16.59'<br>Thu Jul 10 10:46:48 2014: Stale context 'BLOCK_84.23.16.59' deleted<br>Thu Jul 10 10:46:48 2014: Executing shell command '/etc/apf/apf -u 84.23.16.59'<br>Thu Jul 10 10:46:48 2014: Child 14658 created for command '/etc/apf/apf -u 84.23.16.59'<br>Thu Jul 10 16:38:07 2014: Creating event 'WHITELIST, 84.23.16.59, ssh-w1'<br>Thu Jul 10 16:38:07 2014: Creating context 'WHITELIST_84.23.16.59'<br>Fri Jul 11 09:02:16 2014: Creating event 'BLOCK, 84.23.16.59, proftpd-b4'<br>Fri Jul 11 09:02:16 2014: BLOCK, 84.23.16.59, proftpd-b4<br>Fri Jul 11 09:02:16 2014: Executing shell command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Fri Jul 11 09:02:16 2014: Child 3300 created for command '/etc/apf/apf -d 84.23.16.59 dFixblock2'<br>Fri Jul 11 09:02:16 2014: Creating context 'BLOCK_84.23.16.59'<br><br>Thanks<br><br>Colin<br><br>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br>http://mail.blueonyx.it/mailman/listinfo/blueonyx<br></blockquote><br>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br>http://mail.blueonyx.it/mailman/listinfo/blueonyx<br></blockquote></div><br></div></body></html>