cancel
Showing results for 
Search instead for 
Did you mean: 

FTP bad logins

Mark Zukas
Occasional Contributor

FTP bad logins

How do I get my ftp bad logins to showup in my btmp file. Currently, we have realized that they show up as good logins in the wtmp file; but not as bad logins in the btmp file.
3 REPLIES
Antoanetta Naghiu
Esteemed Contributor

Re: FTP bad logins

Edit /etc/inetd.conf file:
in ftp line start the ftpd daemon with -l option:
ftp stream tcp nowait root /usr/lbin/ftpd -l
recycle ined daemon: /usr/sbin/inetd -c.
That will allow to log ftp entries into syslog file (/var/adm/syslog/syslog.log).
Anthony deRito
Respected Contributor

Re: FTP bad logins

I am not sure if this will help you but the ftpd on the ftp server should be logging ALL calls to the /var/adm/syslog/syslog.log file if you have informational events turned on for logging. Here is a example:

Good loggin:

connection from ptscp536.ptsc.slg.eds.com at ftpd[29442]: FTP LOGIN FROM ptscnt6, pde
ftpd[29442]: PORT
ftpd[29442]: User pde logged out

Bad loggin:

connection from cxixnt5 at ftpd[289]: User root: Login incorrect
ftpd[290]: connection from cxixnt5
ftpd[290]: User deritag: Login incorrect

Tony
Brian M. Fisher
Honored Contributor

Re: FTP bad logins

I don't know how to get bad ftp logins sent to the btmp file, but what I did was in /etc/inetd.conf change the end of the ftpd line to be ftpd -l -v

This will cause ftp information, including bad logins, to be logged to /var/adm/syslog/syslog.log

After making the change, issue the command inetd -c

Brian
<*(((>< er
Perception IS Reality