RE: Massive failed FTP attempts.

[James Finnican <jfinnica () bebe com>]

I use Filezilla FTP Server. Filezilla has an option that allows you to block an IP for a certain period of time after a 
certain number of unsuccessful login attempts. Currently, I ban an IP for 24hrs after 10 attempts.

You are going to have to check your FTP server software for any options that might allow you to set rules allowing this 
function.

James

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Michael Nielson
Sent: Friday, August 31, 2007 8:33 PM
To: security-basics () securityfocus com
Subject: Massive failed FTP attempts.

I run several small LAMP virtual servers, I've noticed a large amount of
failed FTP login attempts, these all attempt to login with common FTP
usernames like Administrator, or webmaster (the FTP server is proFTPd
version 1.2.10).  The attacker will try from one IP address maybe 30 or
40 times and then moving to a new IP address.  I have several questions,
first what are they trying to do? Crack my password? Or exploit a bug
with proftpd?  I've been more diligent about choosing a difficult to
break password.  More important what can I do to limit the number of
attempts on my server?
Thanks tons!
Michael