ftpd[7838]:data port : 20

[Santosh P Karpe]

I have this messages in syslog but that day from which IP adrr this ftp session is not recorded in log
For one server
Apr 11 16:25:05 MYHP1 ftpd[4069]: FTP session closed

Second
Apr 11 16:26:10 MYHP2 ftpd[18483]: FTP session closed

Anyone help me that what this log means.Is there any done this FTP ?

Santosh Karpe

[Dennis Handly · Accepted solution]

I assume all it means is that someone finished their ftp session. Is there anything more you wanted logged?

[Santosh P Karpe]

Apr 11 16:24:32 MYHP1 ftpd[7838]: Data port : 20
Apr 11 16:24:32 MYHP1 ftpd[7838]: FTP server (Revision 1.1 Version wuftpd-2.6.1(PHNE_34698) Fri Nov 10 10:21:03 GMT 2006) r
eady.
Apr 11 16:24:32 MYHP1 ftpd[7838]: FTP session closed

This three logs are recorded in one Appl. server

[Dennis Handly]

This just says that someone logged onto your system with ftp at Apr 11 16:24:32 and didn't spend very long.

[Santosh P Karpe]

Is there any way to find who is logged.?
in last command it is not showing that/


Santosh Karpe

[Dennis Handly]

>Is there any way to find who is logged? last command is not showing that.

You'll have to configure logging in ftpaccess(4).
http://docs.hp.com/en/B2355-90685/ch02s09.html?btnNext=next%A0%BB

ftpd(1M) also says that if you start it with -w, it logs in the wtmps files.
http://docs.hp.com/en/B2355-60130/ftpd.1M.html

You'll probably have to edit /etc/inetd.conf to add that -w. Then restart by inetd -c.

[Dennis Handly]

Here are some other threads on ftp logging:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1197280
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1191004
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1147655
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1077154
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1077043

[Santosh P Karpe]

Hi

in /etc/inetd.conf having this entry

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -la


So i wan to know that time who is done FTP sothat this log cerated in syslog (mention 1 question)

Plz if anyone knows tell me?

THanks
Santosh Karpe

[Aneesh Mohan]

Hi Santhosh,


Since the ftp logging is enabled in inetd.conf you should get the information login name ,login time and client ip address in syslog.


example:-

Jan 18 02:51:09 ManamaZim ftpd[5287]: FTP LOGIN FROM 192.168.20.229 [192.168.20.
229], root


Thanks,
Aneesh

[Santosh P Karpe]

Hi Aneesh

Problem is that That day only FTP session closed logged.
Not IP Username mentioned there.

Thanks

Santosh Karpe