ftp log

[Joseph Bague]

Hi all

I noticed that one of our service has lot of this log:

Nov 28 17:00:14 erpbckup ftpd[22057]: FTP session closed
Nov 28 17:00:44 erpbckup ftpd[22060]: FTP session closed
Nov 28 17:01:24 erpbckup ftpd[22062]: FTP session closed

But there is no client ip on the log.
It is possible that server is being hacked?

[Steve Steel]

Hi


If this is 11i then you use WU ftp

see

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4d138f960573d611abdb0090277a778c,00.html

It may be suppressed in the config file

On the machine ftp to itself
open connection
ls
close

Post last 10 lines of syslog.log


Regards

Steve Steel

Quote of the moment
-------------------
"We are drowning in information but starved for knowledge."
-- John Naisbitt

[Chris Wilshaw · Accepted solution]

Do you have the enhanced logging set up on ftpd?

Check /etc/inetd.conf

If you see
ftp stream tcp nowait root /usr/lbin/ftpd ftpd

you have normal logging.

If you see

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

you've got the detailed logging set up, which should report which files are copied, and also any directories that are created.

[Niraj Kumar Verma]

This is normal log file because of

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

in your inetd.conf

and also your inetd deamon is running with -l option.


Regards
-Niraj

[Joseph Bague]

We are using HP-UX 11.