topic Re: ftp log in Operating System - HP-UX

ftp log

Joseph Bague — Thu, 28 Nov 2002 10:16:11 GMT

Hi all

I noticed that one of our service has lot of this log:

Nov 28 17:00:14 erpbckup ftpd[22057]: FTP session closed
Nov 28 17:00:44 erpbckup ftpd[22060]: FTP session closed
Nov 28 17:01:24 erpbckup ftpd[22062]: FTP session closed

But there is no client ip on the log.
It is possible that server is being hacked?

Re: ftp log

Steve Steel — Thu, 28 Nov 2002 10:27:45 GMT

Hi

If this is 11i then you use WU ftp

see

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4d138f960573d611abdb0090277a778c,00.html

It may be suppressed in the config file

On the machine ftp to itself
open connection
ls
close

Post last 10 lines of syslog.log

Regards

Steve Steel

Quote of the moment
-------------------
"We are drowning in information but starved for knowledge."
-- John Naisbitt

Re: ftp log

Chris Wilshaw — Thu, 28 Nov 2002 10:30:03 GMT

Do you have the enhanced logging set up on ftpd?

Check /etc/inetd.conf

If you see
ftp stream tcp nowait root /usr/lbin/ftpd ftpd

you have normal logging.

If you see

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

you've got the detailed logging set up, which should report which files are copied, and also any directories that are created.

Re: ftp log

Niraj Kumar Verma — Thu, 28 Nov 2002 10:59:20 GMT

This is normal log file because of

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

in your inetd.conf

and also your inetd deamon is running with -l option.

Regards
-Niraj

Re: ftp log

Joseph Bague — Fri, 29 Nov 2002 01:56:56 GMT

We are using HP-UX 11.