ftp IP report

[Andre Augusto Ferreira]

Hi people,

When occurs a ftp connection failure, is it possible the ftpd daemon report in syslog the source connection IP?

The message show me:

Nov 21 18:11:10 japoata ftpd[21984]: pam_authenticate: Authentication failed
Nov 21 18:14:21 japoata ftpd[22119]: pam_authenticate: Authentication failed

But I need the IP from the request. I modified the /etc/inetd.conf, including the option on ftpd line:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -o -v -L

Can anyone help me or give me an idea?

Thank you very much

Andre

[Murat SULUHAN]

Hi Andre

You can use proftpd more powerfull, more configurable than ftpd

For example you can configure its log format. Please check the following url
http://www.proftpd.org/docs/directives/linked/config_ref_LogFormat.html

Best Regards
Murat

[Ivan Krastev]

Hi Andre,

have you reloaded inetd daemon (inetd -c) to reread new configuration ?

Can you also give yuor ftp and OS version ?


regards,
ivan

[Andre Augusto Ferreira]

Hi guys,

Yes, I run inetd -c, but IP wasn't reported.

Follow the informations:

japoata:/ # uname -a
HP-UX japoata B.11.11 U 9000/800 1731243075 unlimited-user license

Conectado a 10.128.11.57.
220 passabem FTP server (Version 1.1.214.4(PHNE_34544) Fri Feb 24 15:03:24 GMT 2

I can't install other ftp product becouse it's used by applications that require ftp.

Thanks again

Regards

[Andre Augusto Ferreira]

I've made some tests of connections attempts, and show me the IP after 5 repeated logins failures:

Nov 23 10:28:15 passabem ftpd[14270]: USER root
Nov 23 10:28:16 passabem ftpd[14270]: PASS password
Nov 23 10:28:16 passabem ftpd[14270]: pam_authenticate: Authentication failed
Nov 23 10:28:16 passabem ftpd[14270]: User root: Login incorrect
Nov 23 10:28:34 passabem ftpd[14270]: USER root
Nov 23 10:28:35 passabem ftpd[14270]: PASS password
Nov 23 10:28:35 passabem ftpd[14270]: pam_authenticate: Authentication failed
Nov 23 10:28:35 passabem ftpd[14270]: User root: Login incorrect
Nov 23 10:28:40 passabem ftpd[14270]: USER root
Nov 23 10:28:40 passabem ftpd[14270]: PASS password
Nov 23 10:28:40 passabem ftpd[14270]: pam_authenticate: Authentication failed
Nov 23 10:28:40 passabem ftpd[14270]: User root: Login incorrect
Nov 23 10:28:48 passabem ftpd[14270]: USER root
Nov 23 10:28:48 passabem ftpd[14270]: PASS password
Nov 23 10:28:48 passabem ftpd[14270]: pam_authenticate: Authentication failed
Nov 23 10:28:48 passabem ftpd[14270]: User root: Login incorrect
Nov 23 10:28:55 passabem ftpd[14270]: USER root
Nov 23 10:28:55 passabem ftpd[14270]: PASS password
Nov 23 10:28:55 passabem ftpd[14270]: pam_authenticate: Authentication failed
Nov 23 10:28:55 passabem ftpd[14270]: User root: Login incorrect
Nov 23 10:28:55 passabem ftpd[14270]: REPEATED LOGIN FAILURES FROM 10.128.80.31
Nov 23 10:28:55 passabem ftpd[14270]: FTP session closed

Is it possible reduce this feature to show in each failure login? Or, I don´t know, some other configuration or parameter?

Thanks