Hi,

my RaQ crashed two days ago and also today (a few hours ago).

One thing I noticed while looking at the logs is:

Apr 26 19:45:03 cartman proftpd[8159]: cartman.xxxxx.xx (localhost[127.0.0.1]) - FTP session opened.
Apr 26 19:45:03 cartman proftpd[8159]: cartman.xxxxx.xx (localhost[127.0.0.1]) - no such user 'anonymous'
Apr 26 19:45:03 cartman proftpd[8159]: cartman.xxxxx.xx (localhost[127.0.0.1]) - no such user 'anonymous'
Apr 26 19:45:03 cartman proftpd[8159]: cartman.xxxxx.xx (localhost[127.0.0.1]) - FTP session closed.


I don't know if this has to do with the crashes, but how can I find out from where this guy is coming? It always says localhost[127.0.0.1] (looking at /var/log/messages)

And right before the server crashed I had the following in the logs:

Apr 26 18:38:34 cartman kernel: possible SYN flooding on port 80. Sending cookies.


Is there anything I can/should do against SYN flooding? I have a RaQ3 at 4Webspace.

Thanks in advance for any help.

if you get multiple processes at the same time most likely you are being DOSed or at least someone is attempting to. you should ban the IP at the very least.

You need install IPCHAINS for security.

Please, see this information:

http://www.xprowler.com/ipchains.html

Thanks for the ipchains link, I'm going to check it out now, and hopefully I don't mess things up :D