Some seem think so, anyway. They know only Windows, some perhaps some Linux as well. Here’s the proof from the FTP logfile:
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 202.102.170.171 at 9-MAR-2008 03:21:20.68
%TCPIP-E-FTP_LOGFAL, remote interactive login failure Administrator
-TCPIP-I-FTP_NODE, client host name: 202.102.170.171
-LOGIN-F-NOSUCHUSER, no such user
and 9 more. Someone else is even more stubborn:
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 64.31.150.241 at 9-MAR-2008 12:27:24.84
%TCPIP-E-FTP_LOGFAL, remote interactive login failure Administrator
-TCPIP-I-FTP_NODE, client host name: 64.31.150.241
-LOGIN-F-NOSUCHUSER, no such user
and tries 17 more times.
To no avail of course 😀
Stupid scripts that do not check for return status. Dumb users (well, what would you expect…)
Someone else tried both – again some stupid script kiddy that has no clue whatsoever. And again, a bad scripts as well, since it continues to probe within 6 seconds regardless errors (I took out part that’s equal to all)
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from dslb-088-065-062-223.pools.arcor-ip.net at 11-MAR-2008 03:20:14.23
%TCPIP-I-FTP_NODE, client host name: dslb-088-065-062-223.pools.arcor-ip.net
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: /pub/
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC00042: Failed to set default directory
%SYSTEM-W-BADIRECTORY, bad directory file format
%TCPIP-I-FTP_OBJ, object: /public/incoming/
%TCPIP-I-FTP_OBJ, object: /pub/incoming/
%TCPIP-I-FTP_OBJ, object: /incoming/
%TCPIP-I-FTP_OBJ, object: /upload/
%TCPIP-I-FTP_OBJ, object: /_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /_vti_txt/
%TCPIP-I-FTP_OBJ, object: /_vti_log/
%TCPIP-I-FTP_OBJ, object: /wwwroot/
%TCPIP-I-FTP_OBJ, object: /anonymous/
%TCPIP-I-FTP_OBJ, object: /public/
%TCPIP-I-FTP_OBJ, object: WEB_DISK2:[public.anonymous.080311032002p]
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC00042: Failed to create directory
%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation
This was signaled in OPERATOR.LOG so it attracted my attention:
%%%%%%%%%%% OPCOM 11-MAR-2008 03:20:15.45 %%%%%%%%%%%
Message from user TCPIP$FTP on DIANA
User Name: anonymous
Source: dslb-088-065-062-223.pools.arcor-ip.net
Status: NOPRIV--File access violation
Object: WEB_DISK2:[public.anonymous.080311032002p]
and it went on probing:
%TCPIP-I-FTP_OBJ, object: /outgoing/
%TCPIP-I-FTP_OBJ, object: /temp/
%TCPIP-I-FTP_OBJ, object: /tmp/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /anonymous/incoming/
%TCPIP-I-FTP_OBJ, object: /mailroot/
%TCPIP-I-FTP_OBJ, object: /ftproot/
%TCPIP-I-FTP_OBJ, object: /anonymous/pub/
%TCPIP-I-FTP_OBJ, object: /anonymous/public/
%TCPIP-I-FTP_OBJ, object: /_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /images/
%TCPIP-I-FTP_OBJ, object: /_private/
%TCPIP-I-FTP_OBJ, object: /cgi-bin/
%TCPIP-I-FTP_OBJ, object: /usr/
%TCPIP-I-FTP_OBJ, object: /usr/incoming/
%TCPIP-I-FTP_OBJ, object: /home/
%TCPIP-I-FTP_SESDCN, FTP SERVER: session disconnection from dslb-088-065-062-223.pools.arcor-ip.net at 11-MAR-2008 03:20:16.21