[root@sneaker david]# cat /var/log/auth.log | grep ftp
Oct 7 02:02:12 localhost useradd[6915]: new group: name=ftp, gid=78
Oct 7 02:02:12 localhost useradd[6915]: new user: name=ftp, UID=78, GID=78, home=/var/ftp, shell=/bin/false
Oct 7 03:01:02 sneaker msec: changed mode of /etc/rc.d/init.d/proftpd from 755 to 700
Oct 7 03:12:15 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:12:36 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:12:36 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:12:46 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:13:07 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:13:07 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:13:17 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:20:49 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:21:10 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:21:10 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:21:20 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:21:41 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:21:41 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:21:51 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:23:07 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:23:07 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:23:16 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:23:16 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:23:34 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:23:54 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:23:54 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:23:54 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:25:54 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:25:54 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:31:01 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:31:22 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:31:22 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:31:22 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:31:44 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:31:44 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:31:44 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:31:58 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:31:58 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:31:58 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:31:58 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:31:58 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:31:58 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:32:19 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:32:41 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:32:41 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:32:41 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:33:02 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:33:02 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:33:02 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:35:02 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:35:02 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:38:44 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:38:50 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:38:50 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:39:06 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:39:27 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:39:27 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:39:27 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:39:48 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:39:48 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:39:48 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:40:14 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:40:14 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:43:18 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:45:18 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:45:18 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:52:36 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:53:05 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:53:05 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 03:53:52 sneaker proftpd: pam_unix(proftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser=david rhost=::ffff:192.168.0.23 user=david
Oct 7 03:54:00 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 03:54:06 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 03:54:06 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 04:04:53 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 04:05:14 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 04:05:14 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 04:18:19 sneaker proftpd: pam_unix(proftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser=david rhost=::ffff:68.228.57.142 user=david
Oct 7 04:18:25 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 04:18:41 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 04:18:41 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 04:19:08 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 04:19:33 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 04:19:33 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 04:19:33 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 04:19:58 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 04:19:58 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 04:19:58 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 04:21:58 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 04:21:58 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:41:33 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:41:54 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:41:54 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:41:54 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:42:15 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:42:15 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:42:15 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:44:15 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:44:15 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:47:32 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:47:53 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:47:53 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:47:53 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:48:14 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:48:14 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 16:48:14 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 16:50:14 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 16:50:14 sneaker proftpd: pam_unix(proftpd:session): session closed for user david
Oct 7 19:02:46 sneaker sshd[7582]: User ftp not allowed because account is locked
Oct 7 19:02:46 sneaker sshd[7583]: input_userauth_request: invalid user ftp
Oct 7 19:02:46 sneaker sshd[7582]: Failed password for invalid user ftp from 61.143.0.183 port 56752 ssh2
Oct 7 20:07:21 sneaker proftpd: pam_unix(proftpd:session): session opened for user david by (uid=0)
Oct 7 20:17:04 sneaker proftpd: pam_env(proftpd:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
Oct 7 20:17:04 sneaker proftpd: pam_unix(proftpd:session): session closed for user david