[3905] in WWW Security List Archive
gopher
daemon@ATHENA.MIT.EDU (Helen Reilly)
Fri Dec 27 19:02:16 1996
Date: Fri, 27 Dec 1996 15:04:22 -0500
From: aisecur!HReilly@bpd.treas.gov (Helen Reilly)
To: firewalls@greatcircle.com, www-security@ns2.rutgers.edu
Errors-To: owner-www-security@ns2.rutgers.edu
Hi,
I'm pretty new to web security and this is probably a "dumb"
question. BUT...I would appreciate any help. I have a ftp
site running under NT 4.0 and using IIS 2.0. I have recently
started seeing the following messages in my logfiles. Should
I be concerned? How are what looks like gopher commands being
executed over ftp ports to the ftp server?
Thanks in advance.
Helen
The log follows, (edited)
xxx.xxx.xxx.xxx, anonymous, 12/25/96, 20:16:07, MSFTPSVC, FTP, -, 0,
16, 0, 0, 0, [1129] USER , anonymous, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:07, MSFTPSVC, FTP, -, 0,
15, 0, 0, 0, [1129] PASS , harvest@, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:08, MSFTPSVC, FTP, -, 0,
46, 0, 0, 2, [1129] sent , /, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:08, MSFTPSVC, FTP, -, 0,
19, 0, 0, 2, [1129] sent , /README, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:08, MSFTPSVC, FTP, -, 0,
18, 0, 0, 0, [1129] QUIT , -, -,
xxx.xxx.xxx.xxx, anonymous, 12/25/96, 20:16:12, MSFTPSVC, FTP, -, 0,
16, 0, 0, 0, [1130] USER , anonymous, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:12, MSFTPSVC, FTP, -, 10,
15, 0, 0, 0, [1130] PASS , harvest@, -,
xxx.xxx.xxx.xxx, anonymous, 12/25/96, 20:16:12, MSFTPSVC, FTP, -, 0,
16, 0, 0, 0, [1131] USER , anonymous, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:12, MSFTPSVC, FTP, -, 0,
15, 0, 0, 0, [1131] PASS , harvest@, -,
xxx.xxx.xxx.xxx, anonymous, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
16, 0, 0, 0, [1132] USER , anonymous, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
15, 0, 0, 0, [1132] PASS , harvest@, -,
xxx.xxx.xxx.xxx, anonymous, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
16, 0, 0, 0, [1133] USER , anonymous, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
109, 0, 0, 2, [1130] sent , /internal-gopher-binary, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
15, 0, 0, 0, [1133] PASS , harvest@, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
34, 0, 0, 0, [1130] QUIT , -, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
103, 0, 0, 2, [1131] sent , /internal-gopher-text, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
112, 0, 0, 2, [1132] sent , /internal-gopher-unknown, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
32, 0, 0, 0, [1131] QUIT , -, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
35, 0, 0, 0, [1132] QUIT , -, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
106, 0, 0, 2, [1133] sent , /internal-gopher-image, -,
xxx.xxx.xxx.xxx, harvest@, 12/25/96, 20:16:13, MSFTPSVC, FTP, -, 0,
33, 0, 0, 0, [1133] QUIT , -, -,
