Jeremy, you've got two different things happening here.
> May 11 10:09:25 pooky ftpd[902]: ANONYMOUS FTP LOGIN FROM
> modemcable123.66-200-24.mtl.mc.videotron.ca [24.200.66.123], [EMAIL PROTECTED]
> May 11 10:09:29 pooky ftpd[902]: FTP session closed
> May 12 02:43:20 pooky ftpd[913]: ANONYMOUS FTP LOGIN FROM
> pD954160F.dip.t-dialin.net [217.84.22.15], [EMAIL PROTECTED]
> May 12 02:43:33 pooky ftpd[913]: FTP session closed
> May 14 14:47:22 pooky ftpd[982]: FTP session closed
> May 14 18:48:00 pooky ftpd[987]: FTP session closed
Well, these *are* FTP logins. wu-ftpd doesn't run all the time, but is
spawned from inetd when a connection comes in. Check /etc/inetd.conf
and comment out the entry for ftpd. Then re-start inetd.
Have you been rooted? Can't tell from that, though probably not. But if
your wu-ftpd isn't up to date then you might be. That's precisely what
these two guys are looking for, in all likelihood.
> May 12 02:15:26 pooky /sbin/mingetty[894]: tty1: invalid character ^I in
> login name
This is probably your cat walking across the keyboard. Well, that's
usually what it is around my place. :) This is the error message you get
when there's anything like a cursor character in the login name someone
typed at the console.
Stil
--
Stilgherrian, Director of Operations
Taurfish Pty Ltd (ACN 084 970 178)
http://www.taurfish.com.au/
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
