Atomicorp

Scott,

I am now logging heaps of events as follows in asl-web-gui level 3 events:

This started the moment psa-proftpd was updated.

12:21:52 server proftpd[7489]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - FTP session op 11201 3
12:21:52 server sshd[7231]: pam_unix(sshd:session): session closed for user root 5502 3
12:21:52 server proftpd[7489]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - USER aus-city: 11205 3
12:22:02 server proftpd[7498]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - FTP session op 11201 3
12:22:02 server proftpd[7498]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - USER aus-city: 11205 3
12:22:22 server proftpd[7516]: localhost6.localdomain6 (203.14.171.15[203.14.171.15]) - FTP 11201 3
12:22:22 server proftpd[7516]: localhost6.localdomain6 (203.14.171.15[203.14.171.15]) - USER 11205 3
12:22:22 server proftpd[7521]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - FTP session op 11201 3
12:22:22 server proftpd[7521]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - USER aus-city: 11205 3
12:22:52 server proftpd[7534]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - FTP session op 11201 3
12:22:52 server proftpd[7534]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - USER aus-city: 11205 3
12:23:12 server proftpd[7547]: localhost6.localdomain6 (10.0.0.1[10.0.0.1]) - FTP session op 11201 3


Problem is these will appear in the ossec emails?

Please keep these posts in the correct forum. The psa-proftpd package is not covered by ASL support.

Okay sorry its atomic support.

Resolved - your proftpd.pam is wrong.

I corrected it and the PAM errors are gone. I filed this before F8 was EOL, its been upstream since then. I then rebuilt the rpm from source with updated proftpd.pam

It's been noted in fedora upstream as I reported the bug in bugzilla it's a known issue for chrooted enviroments for proftpd.

Note you MUST comment it out as noted in the file.

Im using the one from plesk, so they're the upstream in this case. I would report this to parallels.

Hi Scott,

The last one from parallels matched what I have now.

I think they use different ones depending on what the OS is, I can only speak for both Fedora 8 and a friend has a Fedora 7 server, both look like mine.

I can put them here on the weekend if you want.