topic Re: FTP log in Operating System - HP-UX

FTP log

Wendy_9 — Wed, 23 Jul 2003 08:19:17 GMT

Hi,

Apart from syslog.log, does anyone know that there is any log recorded the unsuccessful and successful ftp login which can show the IP and username.

Regards,
Wendy

Re: FTP log

twang — Wed, 23 Jul 2003 08:29:48 GMT

For successful ftp login :
# last |grep ftp

Re: FTP log

Tony Constantine — Wed, 23 Jul 2003 08:40:04 GMT

syslog.log is the only log where ftp details could be recorded - IF it is switched on in /etc/inetd.conf (ftpd -Lv)

The only other possibility is if someone has modified /etc/syslog.conf to redirect ftp logs to a different file than syslog, eg;

local5.info;mail.none /var/adm/syslog/ftp.log

In this case ftp messages dont go to syslog but to ftp.log.

Re: FTP log

Alexander M. Ermes — Wed, 23 Jul 2003 08:44:24 GMT

Hi Wendy.
Yes, there is.
If you configure your inetd in /etc/inetd.conf.
You should find a line starting with ftp.

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -u 022 -i -o -B8

-l means logging into /var/adm/syslog/syslog.log.

-u gives you the umask for the creation of a file by ftp

-i writes transfers to /var/adm/syslog/xferlog.
This file contains all successfully transfered files.

-B size
Sets the buffer size of the data socket to size
blocks of 1024 bytes. The valid range for size is from 1 to 64.

If you change your ftp line like this, you should have your problem solved. But keep an eye on this file.
It may grow fast.
Rgds
Alexander M. Ermes

Re: FTP log

Alexander M. Ermes — Wed, 23 Jul 2003 08:46:50 GMT

Sorry, forgot to tell you have to restart the inetd after the change.
Alexander M. Ermes

Re: FTP log

Wendy_9 — Wed, 23 Jul 2003 08:48:14 GMT

Hi,

That means I cannot know the IP of the user that has unsuccessful FTP login.

Is it correct??

Regards,
Wendy

Re: FTP log

Alexander M. Ermes — Wed, 23 Jul 2003 08:54:05 GMT

Hi Wendy.
You can see the ftp logins in /var/adm/syslog/syslog.log .
Only the successful jobs will be logged in /var/adm/syslog/xferlog.

syslog.log :

Jul 23 09:03:29 hpnss-01 ftpd[3815]: FTP LOGIN FROM densswks0035.win.europe.ups.com [10.131.245.57], root

xferlog :

Wed Jul 23 09:05:16 2003 0.880501 densswks0035.win.europe.ups.com 1082794 /opt/cfg2html/hpnss-01.txt b _ o r root ftp 0 * 1058943916 0.000000

Rgds
Alexander M. Ermes

Re: FTP log

Stefan Farrelly — Wed, 23 Jul 2003 08:58:09 GMT

correct

Re: FTP log

Alexander M. Ermes — Wed, 23 Jul 2003 09:11:45 GMT

Wendy,
you should work on your reputation in assigning points.
;-)
Rgds
Alexander M. Ermes

Re: FTP log

twang — Wed, 23 Jul 2003 11:25:47 GMT

Wendy,
Yes, for successful ftp login, you may issue "last |grep ftp". And you may see syslog.log for details.
As i know that no log records unsuccessful ftp login information.

regards
twang