1

Logwatch shows that proftpd was tried to be logged into using root

0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted

I found:

Normally, proftpd does not allow root logins under any circumstance. If a client attempts to login as root, using the correct password, a special security message is logged:

  SECURITY VIOLATION: Root login attempted

It says login as root, using the correct password. How do I find out which password the hacker knows?

Improve this question
1
  • 3
    I'm a bit confused. Reading your question it seems like it answers itself: the hacker knows the root password. – Conor Mancone Sep 17 '20 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.