topic Re: FTP bad logins in Operating System - HP-UX

FTP bad logins

Mark Zukas — Tue, 01 Aug 2000 15:27:28 GMT

How do I get my ftp bad logins to showup in my btmp file. Currently, we have realized that they show up as good logins in the wtmp file; but not as bad logins in the btmp file.

Re: FTP bad logins

Antoanetta Naghiu — Tue, 01 Aug 2000 15:33:56 GMT

Edit /etc/inetd.conf file:
in ftp line start the ftpd daemon with -l option:
ftp stream tcp nowait root /usr/lbin/ftpd -l
recycle ined daemon: /usr/sbin/inetd -c.
That will allow to log ftp entries into syslog file (/var/adm/syslog/syslog.log).

Re: FTP bad logins

Anthony deRito — Tue, 01 Aug 2000 15:38:45 GMT

I am not sure if this will help you but the ftpd on the ftp server should be logging ALL calls to the /var/adm/syslog/syslog.log file if you have informational events turned on for logging. Here is a example:

Good loggin:

connection from ptscp536.ptsc.slg.eds.com at ftpd[29442]: FTP LOGIN FROM ptscnt6, pde
ftpd[29442]: PORT
ftpd[29442]: User pde logged out

Bad loggin:

connection from cxixnt5 at ftpd[289]: User root: Login incorrect
ftpd[290]: connection from cxixnt5
ftpd[290]: User deritag: Login incorrect

Tony

Re: FTP bad logins

Brian M. Fisher — Tue, 01 Aug 2000 15:39:29 GMT

I don't know how to get bad ftp logins sent to the btmp file, but what I did was in /etc/inetd.conf change the end of the ftpd line to be ftpd -l -v

This will cause ftp information, including bad logins, to be logged to /var/adm/syslog/syslog.log

After making the change, issue the command inetd -c

Brian
<*(((>< er