请高手帮忙看看

bill01

1. --------------------- pam_unix Begin ------------------------
   
2. 
   
3. proftpd:
   
4.     Unknown Entries:
   
5.        session closed for user aaa: 6 Time(s)
   
6.        session opened for user aaa by (uid=0): 5 Time(s)
   
7.        session closed for user bbb: 4 Time(s)
   
8.        session opened for user bbb by (uid=0): 4 Time(s)
   
9.        session closed for user fff: 2 Time(s)
   
10.        session closed for user ddd: 2 Time(s)
    
11.        session closed for user eee: 2 Time(s)
    
12.        session opened for user fff by (uid=0): 2 Time(s)
    
13.        session opened for user ddd by (uid=0): 2 Time(s)
    
14.        session opened for user eee by (uid=0): 2 Time(s)
    
15.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18668 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
16.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18669 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
17.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18670 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
18.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18671 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
19.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18672 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
20.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18673 ruser=eee rhost=119.184.212.53  user=eee: 1 Time(s)
    
21.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18677 ruser=ggg rhost=119.184.212.53  user=ggg: 1 Time(s)
    
22.        authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18678 ruser=ggg rhost=119.184.212.53  user=ggg: 1 Time(s)
    

复制代码

上面是logwatch的一段内容 连续出现几天了



authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd18678
这样的登陆失败的日志下面还有很多 我没有复制完

我把用户名用aaa bbb代替了
我不明白为什么 黑客能知道我的FTP用户名呢？
这该如何防护
求高手帮忙

只爱睡觉

像是有扫描工具在暴力猜测，不用担心。

bill01

嗯 我把FTP端口改了下 现在已经没有了

xti9er

回复 1# bill01


    可能你的帐户配置文件泄露吧