Date:  Wed, 15 Aug 2007 09:57:19 -0600
From:  "Rodrigo Ordonez Licona" <rodrigo (at mark) xnet.com.mx>
Subject:  [coba-e:10589] Re: FTP Issues
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <200708151556.l7FFu8s7029402 (at mark) admin.xnet.com.mx>
In-Reply-To:  <02a001c7dec5$d5f8bb80$3701a8c0@user33b5201c50>
X-Mail-Count: 10589

You might be confusing swatch with an attack,

"swatch" (I think that is system watch) Does Access FTP every 15 minutes to
check whether FTP, SMTP , and other services are alive and reports them to
the GUI and thorug mail if it finds problem.

On the log you see a simple log in and log out

HTH

Rodrigo O

-----Original Message-----
From: Arthur Sherman [mailto:arturs (at mark) netvision.net.il] 
Sent: Martes, 14 de Agosto de 2007 04:53 p.m.
To: coba-e (at mark) bluequartz.org
Subject: [coba-e:10583] Re: FTP Issues

> Have a BQ server with the SolarSpeed load and just recently the FTP 
> appears to being attacked server ftp up then down every 15mins anyone 
> esle have or had this issue?
> Thank you
> --
> 
> Richard C. Barker Sr.

I do.
As far as I (and others on the List) have discovered, the attack vector is
on PAM, through mail actually.
When PAM fails, FTP fails as well.

Though I am not 100% sure yet.

Best,

--
Arthur Sherman