topic FTP activity in Operating System - HP-UX

FTP activity

Nobody's Hero — Tue, 03 Jun 2003 12:59:09 GMT

I want to track all FTP activity on one of my Nclass systems running 11.0. I don't want to use an auditing tool like IDS or anything. I just want to see who is ftp'ing in and out. Is there a file other than syslog to get some info on this?

10x
RPM

Re: FTP activity

Michael Steele_2 — Tue, 03 Jun 2003 13:04:35 GMT

Toggle off with inetd -l and review syslog.log

Re: FTP activity

Mark Greene_1 — Tue, 03 Jun 2003 13:04:38 GMT

Add the -l option to the ftpd line in the /etc/inetd.conf file. This will log ftp connections in the syslog. See the man page for ftpd for more detail.

You can add a daemon line to the syslog.conf file to seperate daemon generated messages from the syslog to a seperate file, but I don't think you can segragate the ftp messages.

HTH
mark

Re: FTP activity

S.K. Chan — Tue, 03 Jun 2003 13:05:17 GMT

You're in luck because on 11.0 and higher if you check the ftpd daemon.
# man ftpd
.. you should see there is an additional option "-l" , apart from the usual "-v" option. What you can do is include these 2 options in you /etc/inetd.conf file for ftpd service and re-read inetd.conf and you should be getting a more detail ftp logging in syslog.log.

Re: FTP activity

Massimo Bianchi — Tue, 03 Jun 2003 13:05:45 GMT

Isn't syslog enough ?

You can turn tracing on in the /etc/inet.conf at the ftp line. With loggiin enabled, you see: who is in, what is getting, what is deleting and so on...

See man ftpd for details

Otherwise tools like IDS can be used, or you can create an ad hoc account and monitor each connection.

HTH,
Massimo

Re: FTP activity

S.K. Chan — Tue, 03 Jun 2003 13:08:40 GMT

My apology .. it seems 10.20 has the "-v" option too. So just include "-l" and "-v" the in ftpd line.

Re: FTP activity

Bill Douglass — Tue, 03 Jun 2003 13:14:00 GMT

If you use the ftpaccess file (man ftpaccess) you can include command and file transfer logging, in addition to login and logout of ftp users.

File transfers are logged in /var/adm/syslog/xferlog; the remaining records are logged through syslog (with the tag ftpd).