Getting ::ffff: in front of ip

[tolisgr]

Hi, proftpd logs ip's like that:

ProFTPd [14890] ::ffff:123.123.123.123 [27/Mar/2009:17:38:40 +0200] "USER fakeuser" 331
ProFTPd [14890] ::ffff:123.123.123.123 [27/Mar/2009:17:38:40 +0200] "PASS (hidden)" 530

I'm using bfd at my server to block brute force attacks. When someone trying to attack proftpd, bfd blocks the ip but includes the ffff in front of ip (ex. ffff123.123.123.123)

Where is ffff come from ? Is there any way to fix this?

PS. this started to happen today after some software updates I made including 'proftpd'

Thank's in advance

 

[tillo]

The "::ffff:" is something coming from IPv6. Just modify proftpd's config to deactivate IPv6 (if you are not using it) and restart it.

 

[tolisgr]

The "::ffff:" is something coming from IPv6. Just modify proftpd's config to deactivate IPv6 (if you are not using it) and restart it.

I did not find any configuration entry at proftpd config about IPv6. is there any other way?

**update**
ok I managed to make bfd to work. I made this:

nano /usr/local/bfd/rules/proftpd

replaced this:

sed -e 's/::ffff://'

with this:

sed -e 's/::ffff://g'

The sed command deletes the ::ffff: at front of ip so that bfd blocks only the ip without the ffff .
The only that remains is the ffff thing at logs but I don't mind since bfd works

Thank you