Strange FTP behaviour on ISPConfig installation

Discussion in 'Installation/Configuration' started by Unreal, Mar 12, 2024.

Tags:
  1. Unreal

    Unreal New Member

    Hi,

    Just created an account here to talk about some strange behaviour I see and it looks like unexpected to me. All logs shared are anonymized but show the behaviour. Maybe I am missing something and this is expected behaviour but for my feeling I would like to have this confirmed.

    I have a monitoring tool, SIEM etcetera running in my organization as an IT Admin. Now I have recently added our ISPConfig instance to it. But every 5 minutes. It gets a log added "Pure-FTPD: New FTP connection." - the results of the connection are "New connection from 127.0.0.1".

    Isn't it kinda weird that the FTP server is connection to itself every 5 minutes?!
     
    Unreal, Mar 12, 2024
    #1
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Not really weird. ISPConfig monitors the services and checks if they are working, and therefore, it has to connect to the service to test it.
     
    till, Mar 12, 2024
    #2
  3. Unreal

    Unreal New Member

    Thanks! If this is the case then okay! It was to my opinion kinda weird to also see it as a suspicious behaviour attempt in our logging :)
     
    Unreal, Mar 12, 2024
    #3
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    If you use a monitoring system to monitor a service, it will not report itself as suspicious. But if you use a monitoring system to monitor another monitoring system, then the second monitoring system will see the actions of the first monitoring as suspicious :)
     
    till, Mar 12, 2024
    #4

Share This Page