topic Re: FTP logging --- ftpd in Operating System - HP-UX

FTP logging --- ftpd

System Administrator_12 — Fri, 31 Aug 2007 09:31:33 GMT

I added the ftpd options of -l -i -o to /etc/inetd.conf and restarted the service

after checking the /var/adm/syslog/xferlog, I see transfers logged for both inbound and outbound files

THE QUESTION: ftp logging seems to only log transfers that are initiated from another server to the server that is logging activity;

Is there a way to log transfers of sessions that are initiated on the server that's logging?

Re: FTP logging --- ftpd

Patrick Wallek — Fri, 31 Aug 2007 09:44:07 GMT

It would not be nearly as straightforward to log ftp connections initiated on the server via the ftp executable.

You are not seeing these connections logged because they do NOT use the FTPD daemon. FTPD is ONLY listening for incoming connections and only those are logged.

When you FTP from this machine this is completely separated from FTPD that is defined in /etc/inetd.conf.

There is no easy way that I know of to log info from ftp connections initiated on the server that is logging.

Re: FTP logging --- ftpd

System Administrator_12 — Fri, 31 Aug 2007 09:50:06 GMT

Thank you Patrick, After seeing the content of the log and doing some testing, I concluded that the sessions are not using ftpd. I wanted to be sure about my conclusion

Re: FTP logging --- ftpd

A. Clay Stephenson — Fri, 31 Aug 2007 09:56:02 GMT

You are now confusing the role of the ftp server daemon (ftpd) with that of the client, ftp. It would be the task of the foreign ftp server to log those transfers.

What you could do is download the source for one of the ftp clients found on the Porting and Archive Centre and modify it to do whatever logging you wish. Bear in mind that this would only capture FTP traffic and would not capture transfers via email, ssh, rcp, ... or physical media transfers. There would still be a "hole" in FTP client use because any program could make use of the FTP protocol (e.g. a Perl script using the Net::FTP module) and those transfers would be completely hidden from "your" ftp.

You could also create a wrapper script for the "real" ftp command that would at least log who and when an ftp client was started but wouldn't know anything about transfers.