Don’t Enable “FTP Access” on your Mac (or PC) Unless You Really Need It

If you’ve enabled “FTP Access” on your Mac (or PC) you may have an ftp.log full of messages telling you that “people” you don’t know are trying to log in. There will be lots of them, every couple seconds. Some even rotate username’s, and passwords. Open your console and look in ftp.log or secure.log.

Here are some that I found

Mar 20 18:45:36 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:37 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:39 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:44 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:48 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:54 MyComputer ftpd[4666]: FTP LOGIN FAILED FROM 210.18.123.42.sify.net
Mar 20 18:45:54 MyComputer ftpd[4666]: repeated login failures from 210.18.123.42.sify.net

and

Apr 8 21:20:48 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:20:49 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:20:52 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:20:55 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:20:59 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:21:04 MyComputer ftpd[5710]: FTP LOGIN FAILED FROM 32.c8.85ae.static.theplanet.com
Apr 8 21:21:04 MyComputer ftpd[5710]: repeated login failures from 32.c8.85ae.static.theplanet.com

I’ve been enabling “FTP Access” on my Mac and using Filezilla on my PC as a way of moving files back and forth. It works just fine, but this means that “FTP Access” is available to all the Internet :scary: I turned it off. I couldn’t live with this in my ftp.log files.