topic Re: syslog error .. in Operating System - HP-UX

syslog error ..

someone_4 — Tue, 14 Aug 2001 15:05:26 GMT

Hello
I get this error in my syslog.
Aug 13 23:49:18 lvapp01 ftpd[10881]: PAM_TEXT_INFO: Last successful login for root: Mon Aug 13 23:47:07 CST6CDT 2001 on tty .
Aug 13 23:49:18 lvapp01 ftpd[10881]: PAM_TEXT_INFO: Last unsuccessful login for root: Mon Aug 13 16:13:07 CST6CDT 2001 on pts/ta .
Aug 13 23:49:18 lvapp01 ftpd[10881]: FTP LOGIN FROM lvapp14.prod.networkip.net [192.168.10.151], root
Aug 13 23:49:19 lvapp01 ftpd[10881]: FTP session closed

Can someone tell me what this means or if i should fixx it?

Re: syslog error ..

A. Clay Stephenson — Tue, 14 Aug 2001 15:11:21 GMT

Hi Richard,

I suspect that you have enabled inetd logging. It will log when every process is spawned by inetd. Every telnet, every ftp, .... . Because of this, I only enable inetd logging for short periods when I am looking for specific problems. Separating the wheat from the chaff becomes difficult in short order. The PAM messages (Pluggable Authentication Module) indicate login attempts.

Clay

Re: syslog error ..

James R. Ferguson — Tue, 14 Aug 2001 15:17:53 GMT

Hi Richard:

I presume that it's PAM who is bothering you ;-)

PAM stands for "Pluggable Authentication Modules" and is a framework for integrated login. Take a look at the man pages for it ('man 3 pam') for a start and also at chapter-8 "Administering a System: Managing System Security" in "Managing Systems and Workgroups: A Guide for HP-UX System Administrators":

http://docs.hp.com/hpux/onlinedocs/B2355-90701/B2355-90701.html

Regards!

...JRF...

Re: syslog error ..

linuxfan — Tue, 14 Aug 2001 15:30:09 GMT

Hi Richard,

Check you /etc/rc.config.d/netdaemons file and look for variable INETD_ARGS, if it is set to
export INETD_ARGS="-l"
then you would see this logging in the syslog.
To disable this, just set this variable to blank and bounce your inetd (/sbin/init.d/inetd stop; /sbin/init.d/inetd start).

It doesn't look like you have ftp logging enabled but look for the ftp entry in the /etc/inetd.conf.

-HTH
I am RU

Re: syslog error ..

MANOJ SRIVASTAVA — Tue, 14 Aug 2001 15:32:23 GMT

Hi Richard

You have indeed enabled inetd logging , in case the server is critcal interms of restricting ftp/telnet logging then u need to have this on as you can monitor .

Manoj Srivastava

Re: syslog error ..

someone_4 — Tue, 14 Aug 2001 16:38:03 GMT

I disabled inetd as you see in syslog.
But I am still getting this.

Aug 14 11:44:36 lvapp01 inetd[542]: Connection logging disabled
Aug 14 11:58:41 lvapp01 ftpd[24982]: PAM_TEXT_INFO: Last successful login for
root: Tue Aug 14 11:42:26 CST6CDT 2001 on pts/ta .
Aug 14 11:58:41 lvapp01 ftpd[24982]: PAM_TEXT_INFO: Last unsuccessful login for
root: Mon Aug 13 16:13:07 CST6CDT 2001 on pts/ta .
Aug 14 11:58:41 lvapp01 ftpd[24982]: FTP LOGIN FROM lvapp14.prod.networkip.net [
192.168.10.151], root

Re: syslog error ..

linuxfan — Tue, 14 Aug 2001 18:41:43 GMT

Hi Richard,

Are you seeing this logging only for the ftpd?
Check if the logging option is enabled for ftpd in the /etc/inetd.conf file.

-Regards
I am RU

Re: syslog error ..

someone_4 — Thu, 16 Aug 2001 02:14:16 GMT

Does this mean ftpd loggin is on ?
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

Re: syslog error ..

linuxfan — Thu, 16 Aug 2001 02:30:25 GMT

Hi Richard,

The -l option means the loggin is on

From the man page of ftpd
-l Causes each FTP session to be logged in the syslog file.

-l logs each ftp session, where as -L logs each command sent to the ftpd server

-HTH
I am RU

Re: syslog error ..

Sridhar Bhaskarla — Thu, 16 Aug 2001 04:37:15 GMT

Richard,

Did you check your /etc/pam.conf file and see if you have debug option on for ftp?. If so, you need to take it out to get rid of these message

-Sri