Proftpd

OSSEC Alert's related to Proftpd

www proftpd[21489]: http://www.domain.com (10.10.10.10[10.10.10.10]) - Refused PORT 

This was determined to be caused by settings in dreamweaver. Customer did not report what the setting change needed to be. Regardless if ASL was installed or not, ftp would not work because of this *client side* setting.

Strange IPs in Proftp log messages

Jul 1 08:54:23 echo proftpd[1234]: 1.2.3.4 (::ffff:192.168.1.2[::ffff:192.168.1.1]) - USER xyzzy: no such user found from ::ffff:192.168.1.1[::ffff:192.168.1.1]

this means you have Configured proftp to support IPv6 and it is mapping IPv4 to IPv6 addresses. A ":ffff" prefix indicates an IPv4-mapped IPv6 address. To remove these in your standalone proftpd, simply add this to your proftpd.conf:

 UseIPv6 off

Or you can configure IPv6 correctly on your system to support mapping.

Troubleshooting

FTP data stream not working

See the article linked to below:

https://www.atomicorp.com/wiki/index.php/ASL_Troubleshooting#FTP_not_working