Hello! I think that my server is attacked or have something wrong. I can't find a problem. I have hosting server for some web pages. In proftpd log files I see that one client have many failed connections. Code: Mar 16 03:43:44 sample.com proftpd[14151] sample.com (192.168.123.116[192.168.123.116]): FTP session opened. Mar 16 03:43:46 sample.com proftpd[14151] sample.com (192.168.123.116[192.168.123.116]): USER sample_user (Login failed): Incorrect password. Mar 16 03:43:47 sample.com proftpd[14151] sample.com (192.168.123.116[192.168.123.116]): FTP session closed. Mar 16 03:55:35 sample.com proftpd[14319] sample.com (192.168.123.116[192.168.123.116]): FTP session opened. Mar 16 03:55:38 sample.com proftpd[14319] sample.com (192.168.123.116[192.168.123.116]): USER sample_user (Login failed): Incorrect password. Mar 16 03:55:38 sample.com proftpd[14319] sample.com (192.168.123.116[192.168.123.116]): FTP session closed. This local IP 192.168.123.116 is a this hosting server local IP. I see this failture message approx. every 5-10 min. What is it? It is attack? And how I can to resolv this problem! Big thanks!
This is normal on a hosted enviroment, hosting servers get attacked all the time by bots. If you want to protect your server you can use e.g. fail2ban. There are tutorials for fail2ban here on howtoforge.
