[X Servers] xinetd starting mystery FTP

[Eugene Lee]

On Sat, May 29, 2004 at 12:45:24AM -0700, Steve St-Laurent wrote:
: 
: I'm showing these messages in my OS X Server 10.3 system log:
: 
: May 28 16:43:50 HoleComm xinetd[403]: START: ftp pid=18327 from=24.80.152.26
: May 28 17:12:48 HoleComm xinetd[403]: START: ftp pid=18664 from=80.170.195.165
: 
: Has the security been hacked? I don't see any activity showing up in 
: the FTP log.

If you have an FTP server enabled, the above logs are typical and show
that other people are trying to connect via FTP.  Check your FTP logs or
your system logs for messages like:

	May 28 16:43:50 ftp ftpd[18327]: ANONYMOUS FTP LOGIN FROM 24.80.152.26
	May 28 17:12:48 ftp ftpd[18664]: ANONYMOUS FTP LOGIN FROM 80.170.195.165

Better yet, if you don't need FTP, turn it off and switch to SFTP which
is part of SSH.


-- 
Eugene Lee
http://www.coxar.pwp.blueyonder.co.uk/