Ftp account disable

[RK_7]

Dear all,

We have implemented TCB in our server.
Can I find out the IP Address of the FTP User who tries ftp login more than three times with wrong password

Regards

[Peter Godron]

Hi,
would there not be a log in /var/adm/syslog/syslog.log ?

[Steven E. Protter]

Shalom

inetd -l

You can also enhance logging of some protocols by adding the -l paramter to the setup of the daemon in /etc/inted.conf

Note that for ssh, there have been some problems with certain versions that disabled logging. You will need the most recent secure shell server from http://software.hp.com to avoid this issue.

SEP

[RK_7]

Hi,

In syslog I am getting logs for successful login .If the user tries wrong password three times ,the account gets locked .We want to find out the IP Address of user who made the system account locked.Is there any option that can use with ftpd in inetd.conf.

Regards,

[Asif Sharif]

check these logs
1. /var/adm/wtmp
2. /var/adm/syslog/syslog.log

[RK_7]

Hi

From wtmp we will not get ftp login details

[Steven E. Protter]

I thought of something else.

If you went TCB, that means your system is trusted. Unless you change it, be default a trusted system is going to disable a user after three consecutive bad logins.

passwd -sa

That command should produce a report of the bad users. But to actually disable the account you should not have to do anything.

SEP

[Peter Godron]

RK,
when I try to log onto my (untrusted) system with an invalid password I see in the syslog.log.

IP addresses and username removed to protect the innocent.

Mar 28 12:56:57 tpol inetd[26625]: registrar/tcp: Connection from tpol () at Tue Mar 28 12:56:57 2006
Mar 28 12:57:06 tpol inetd[26626]: ftp/tcp: Connection from unknown () at Tue Mar 28 12:57:06 2006
Mar 28 12:57:12 tpol ftpd[26626]: pam_authenticate: Authentication failed
Mar 28 12:57:12 tpol ftpd[26626]: User : Login incorrect

[Antonio Cardoso_1]

Hi,

look at ftpd entry in /etc/inetd.conf : if having -l flag, for example:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -a

the log will look like:
Mar 28 15:19:27 rasteau inetd[18263]: ftp/tcp: Connection from unknown (139.54.129.205) at Tue Mar 28 15:19:27 2006
Mar 28 15:19:30 rasteau ftpd[18263]: cannot stat private access file /etc/ftpd/ftpgroups: No such file or directory
Mar 28 15:19:30 rasteau ftpd[18263]: USER sydfks
Mar 28 15:19:31 rasteau ftpd[18263]: PASS password
Mar 28 15:19:31 rasteau ftpd[18263]: User sydfks: Login incorrect
Mar 28 15:19:31 rasteau ftpd[18263]: SYST
Mar 28 15:19:31 rasteau ftpd[18263]: TYPE Image
Mar 28 15:19:37 rasteau inetd[1104]: Connection logging disabled
Mar 28 15:20:19 rasteau ftpd[18263]: QUIT
Mar 28 15:20:19 rasteau ftpd[18263]: FTP session closed