FreeNAS-11.1-U7, hacking atemps

[dakinet]

Hi im new here,
today while im looking on terminal messages i notice many login atemps on my freenas. Im listing only few here, actualy there is 17 word pages of log with login atemps.
Can somebody explain me what is going on and how to protect myself please
Best Regards

Code:

Nov 17 12:57:58 ssv_server proftpd[79638]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER ftp (Login failed): Incorrect password
Nov 17 12:57:58 ssv_server proftpd[79638]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 12:58:03 ssv_server proftpd[79641]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER ftp (Login failed): Incorrect password
Nov 17 12:58:03 ssv_server proftpd[79641]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 12:58:08 ssv_server proftpd[79707]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER ftp (Login failed): Incorrect password
Nov 17 12:58:08 ssv_server proftpd[79707]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 12:58:11 ssv_server proftpd[79709]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER ftp (Login failed): Incorrect password

Nov 17 13:04:37 ssv_server proftpd[81111]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER user: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:04:37 ssv_server proftpd[81111]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused


Nov 17 13:06:39 ssv_server proftpd[81481]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER user: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:06:39 ssv_server proftpd[81481]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:06:46 ssv_server proftpd[81508]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER user: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:06:46 ssv_server proftpd[81508]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:06:58 ssv_server proftpd[81523]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER user: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:06:58 ssv_server proftpd[81523]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:06:59 ssv_server proftpd[81526]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER user: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:06:59 ssv_server proftpd[81526]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused


Nov 17 13:19:29 ssv_server proftpd[84220]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER www-data: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:19:29 ssv_server proftpd[84220]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:19:35 ssv_server proftpd[84230]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER www-data: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:19:35 ssv_server proftpd[84230]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:19:40 ssv_server proftpd[84261]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER www-data: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:19:40 ssv_server proftpd[84261]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused
Nov 17 13:19:42 ssv_server proftpd[84263]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - USER www-data: no such user found from 103.219.39.218 [103.219.39.218] to ::ffff:192.168.100.250:21
Nov 17 13:19:42 ssv_server proftpd[84263]: 127.0.0.1 (103.219.39.218[103.219.39.218]) - Maximum login attempts (1) exceeded, connection refused

 

[Ericloewe]

Please don't crosspost.

As for your problem, don't expose your *FTP server to the internet.

 

[dakinet]

Hi, thanks for replay, i have mikrotik router after cable modem and on MT i have firewall that block all incoming ports. Also i have port forward that incoming port 2121 redirect to port 21 to server. Atacker ip (103.219.39.218) comes from china. I block port 2121 from outside connections.

Idont know if problem is solved? I must see event log, where i can find event log on freenas?

 

[dakinet]

Now IM receiving messages

Code:

Nov 18 00:00:00 sdi_server newsyslog[18798]: logfile turned over due to size>200K
Nov 18 00:00:00 sdi_server syslog-ng[63558]: Configuration reload request received, reloading configuration;
Nov 18 08:33:24 sdi_server proftpd[4939]: 127.0.0.1 (192.168.100.200[192.168.100.200]) - USER ServerSideRequestForgeryCheckUsername: no such user found from 192.168.100.200 [192.168.100.200] to ::ffff:192.168.100.250:21
Nov 18 08:33:24 sdi_server proftpd[4939]: 127.0.0.1 (192.168.100.200[192.168.100.200]) - Maximum login attempts (1) exceeded, connection refused

 

[Patrick M. Hausen]

I must see event log, where i can find event log on freenas?

/var/log/*

 

[dakinet]

Here is what i have in /var/log/ folder:

 

[Patrick M. Hausen]

So? There is your event log. You asked where to find that. You have to look at the individual files ...

 

[dakinet]

i will check in file "httpd-access.log" maybe is there. Thank you.
Can freenas send email with attached event log, maybe once per month or per week?

 

[Patrick M. Hausen]

Why would you expect ftpd to log in httpd-access.log? Two separate programs.
I'd look in messages, auth.log and xferlog or simply use grep ...

 

[Ericloewe]

Also i have port forward that incoming port 2121 redirect to port 21 to server.

I block port 2121 from outside connections.

These two don't make much sense together. You either forward a port or block it, generally you don't do both (unless you're whitelisting IPs?).