November 10, 20214 yr I turned off the FTP server. Not sure why it was on. There were no usernames in the FTP user(s): slot. Blank. It says user access is disallowed but if I enable the server with no usernames still, I get connections from an internal machine. 9 19:02:42 BlackTower ool www[6129]: /usr/local/emhttp/plugins/dynamix/scripts/ftpusers '1' '' Nov 9 19:02:49 BlackTower vsftpd[8488]: connect from 192.168.1.105 (192.168.1.105) Nov 9 19:02:53 BlackTower ool www[6129]: /usr/local/emhttp/plugins/dynamix/scripts/ftpusers '0' '' Nov 9 19:14:59 BlackTower ool www[2467]: /usr/local/emhttp/plugins/dynamix/scripts/ftpusers '1' '' Nov 9 19:15:12 BlackTower vsftpd[25242]: connect from 192.168.1.105 (192.168.1.105) Nov 9 19:15:27 BlackTower vsftpd[26488]: connect from 192.168.1.105 (192.168.1.105) Nov 9 19:15:32 BlackTower ool www[26467]: /usr/local/emhttp/plugins/dynamix/scripts/ftpusers '0' '' Am I hacked? Scanning for viruses/malware now and installing 'Little Snitch' on my Mac Pro, which is the machine it's coming from.
November 10, 20214 yr Author This *MAY* be Automounter. A tool that keeps shares from disconnecting. Not sure why it would show vsftpd connections other than maybe it's scanning something....
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.