topic Syslog Message > ftpd in Operating System - HP-UX

Syslog Message > ftpd

Nobody's Hero — Tue, 08 Feb 2005 08:49:28 GMT

Can someone explain why I have these messages in my syslog? nobody has access to this box and I am the only one that uses it. Is there a process that uses ftp? What is using ftp?
Just wondering why I am seeing these messages.
Nobody uses ftp on the box.

Re: Syslog Message > ftpd

Henk Geurts — Tue, 08 Feb 2005 08:59:52 GMT

robert
can you post the complete message.

check
/etc/inetd.conf
/var/adm/inetd.sec
/etc/ftpd/ftpaccess
/etc/ftpd/ftpusers
ps -ef|grep ftp

let me know.
regards
Henk

Re: Syslog Message > ftpd

Nobody's Hero — Tue, 08 Feb 2005 09:04:49 GMT

eb 8 06:56:29 ltcrss ftpd[6770]: FTP session closed
Feb 8 07:01:29 ltcrss ftpd[6812]: FTP session closed
Feb 8 07:06:30 ltcrss ftpd[6856]: FTP session closed
Feb 8 07:11:30 ltcrss ftpd[6898]: FTP session closed
Feb 8 07:16:30 ltcrss ftpd[6941]: FTP session closed
Feb 8 07:21:30 ltcrss ftpd[6984]: FTP session closed
Feb 8 07:26:29 ltcrss ftpd[7026]: FTP session closed
Feb 8 07:31:29 ltcrss ftpd[7068]: FTP session closed
Feb 8 07:36:30 ltcrss ftpd[7109]: FTP session closed
Feb 8 07:41:29 ltcrss ftpd[7152]: FTP session closed
Feb 8 07:46:30 ltcrss ftpd[7202]: FTP session closed
Feb 8 07:51:30 ltcrss ftpd[7245]: FTP session closed
Feb 8 07:56:29 ltcrss ftpd[7290]: FTP session closed
Feb 8 08:01:30 ltcrss ftpd[7335]: FTP session closed

Re: Syslog Message > ftpd

harry d brown jr — Tue, 08 Feb 2005 09:05:50 GMT

ftpd is a daemon that responds with some process trying to FTP to YOUR box, not someone on your box trying to FTP to some place else.

Is ftpd disabled?

live free or die
harry d brown jr

Re: Syslog Message > ftpd

Nobody's Hero — Tue, 08 Feb 2005 09:07:43 GMT

Harry,
so you are saying that a process is trying to ftp to this box?

Re: Syslog Message > ftpd

Nobody's Hero — Tue, 08 Feb 2005 09:08:31 GMT

If so, how can I trap the ftp to see what it is. I dont want to turn off ftp.

Re: Syslog Message > ftpd

harry d brown jr — Tue, 08 Feb 2005 09:11:31 GMT

Robert,

You have something/someone trying every FIVE minutes to use FTP to your box. Do you have "lsof" ?? If so, try to catch them and find their IP.

live free or die
harry d brown jr

Re: Syslog Message > ftpd

Nobody's Hero — Tue, 08 Feb 2005 09:13:12 GMT

I have no idea who or what it could be. It must be from the inside. I'll load lsof and give it a try. Where can I find lsof?

Re: Syslog Message > ftpd

Dave Hutton — Tue, 08 Feb 2005 09:17:41 GMT

Robert, you can download it from here:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.74/

For the depot precompiled versions.

Re: Syslog Message > ftpd

Steven E. Protter — Tue, 08 Feb 2005 09:25:53 GMT

Somebody is trying to ftp to the box, quite regularly.

The usual suspects are cron jobs on other boxes. Because of the regularlity of the ouptut, that is why I suspect it.

If you have secure shell openssh working and clients with your users, I'd say go to /etc/inetd.conf and comment out the ftpd daemon.

Then save the file

inetd -c

First, you might want to use enhanced logging, inetd -l and see what the source ip address of the ftp request is. That will narrow your suspect list.

Don't forget to check the cron schedule on this box. I've seen sysadmins do that to themselves on occaision.

< Quickly looks and sees if there is anyone standing behind me. >

SEP

Re: Syslog Message > ftpd

harry d brown jr — Tue, 08 Feb 2005 09:51:22 GMT

Robert,

In inetd.conf, change the ftp line to add the "-l" option. it gives more details in syslog:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

example output:
Feb 8 09:49:06 vpart1 ftpd[27752]: FTP LOGIN FROM rndspt01.paychex.com [10.2.110.1], root
Feb 8 09:49:26 vpart1 ftpd[27752]: root of rndspt01.paychex.com [10.2.110.1] deleted /tmp/xyz
Feb 8 09:49:31 vpart1 ftpd[27752]: FTP session closed
[root@vpart1 /var/adm/syslog]#

live free or die
harry d brown jr

Re: Syslog Message > ftpd

harry d brown jr — Tue, 08 Feb 2005 09:53:35 GMT

After making the change to /etc/inetd.conf, don't forget to issue:

inetd -c

live free or die
harry d brown jr