[Xitami] Annoying FTP-Bots

[Gene]

Xitami FTP is not very stable.  In fact it makes your web unstable. It 
also corrupts files at high speed (my experience). I would just turn it 
off and use a seperate FTP server (guild, warftp, or TinyFTP).  You will 
get a lot better performance for this anyways. 

Also if you go into your windows services you can tell it to auto 
restart the Xitami service on a crash.

As far as the bots I run a art site and these spam bots are hammering my 
site.  If your FTP is for personal use you could move the FTP port to 
something other then 21.  99% of all bots will just be mass scanning 
standard ports.

  Gene

navy nut wrote:
> As of late...
>  
> I've been getting hit quite frequently by something that appears to be 
> a BOT of sorts, trying (in rapid succession) to break entry into my 
> FTP login... using a handful of common generic user-names (and 
> probably an assortment of various common passwords).
>  
> To my knowledge, this "bot thing" has never successfully gained 
> access... but often hammers away several times per minute, for hours 
> on end, until it finally crashes Xitami (if/when it goes undetected).  
> This is most annoying, because it means that I have to keep someone 
> periodically monitoring log-files around the clock.
>  
> At times when I've caught this activity in action, I've simply just 
> closed port 21 on the router for an hour or two, and the bot goes 
> away... but only to return a few days (or whenever it pleases) later, 
> and always identifies itself by a different IP-address upon it's 
> return.  At least I assume it's the same bot... masked behind an 
> available open proxy.
>  
> I'm curious to know if anyone else has had this trouble, and what 
> they've done to correct it.
>  
> A SAMPLE CLIP FROM THE ERROR LOG:
>  
> 140.135.9.174 - admin [07/May/2007:17:44:02 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:04 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:07 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:09 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:12 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:14 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:17 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:19 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:22 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
> 140.135.9.174 - admin [07/May/2007:17:44:24 -0700] 
> "ftp://140.135.9.174/" 530 0 "-" ""
>  
> Rod
>  
>
> ------------------------------------------------------------------------
> Ask a question on any topic and get answers from real people. *Go to 
> Yahoo! Answers.* <http://ca.answers.yahoo.com>
> ------------------------------------------------------------------------
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami