FTP bad logins

[Mark Zukas]

How do I get my ftp bad logins to showup in my btmp file. Currently, we have realized that they show up as good logins in the wtmp file; but not as bad logins in the btmp file.

[Antoanetta Naghiu]

Edit /etc/inetd.conf file:
in ftp line start the ftpd daemon with -l option:
ftp stream tcp nowait root /usr/lbin/ftpd -l
recycle ined daemon: /usr/sbin/inetd -c.
That will allow to log ftp entries into syslog file (/var/adm/syslog/syslog.log).

[Anthony deRito]

I am not sure if this will help you but the ftpd on the ftp server should be logging ALL calls to the /var/adm/syslog/syslog.log file if you have informational events turned on for logging. Here is a example:

Good loggin:

connection from ptscp536.ptsc.slg.eds.com at ftpd[29442]: FTP LOGIN FROM ptscnt6, pde
ftpd[29442]: PORT
ftpd[29442]: User pde logged out

Bad loggin:

connection from cxixnt5 at ftpd[289]: User root: Login incorrect
ftpd[290]: connection from cxixnt5
ftpd[290]: User deritag: Login incorrect

Tony

[Brian M. Fisher]

I don't know how to get bad ftp logins sent to the btmp file, but what I did was in /etc/inetd.conf change the end of the ftpd line to be ftpd -l -v

This will cause ftp information, including bad logins, to be logged to /var/adm/syslog/syslog.log

After making the change, issue the command inetd -c

Brian
<*(((>< er