FTP Messages - Filling up Syslog

[Manoj Sooka]

Hello All

Could someone please assist. On 2 of our servers, messages like the following keep filling up the Syslog. I do not know what is generating the messages as these do not seem to be normal FTP session messages. Any help will be appreciated. I am leaving now and will check your responses tomorrow. Many thanks
Manoj

Apr 22 02:16:13 GFTS ftpd[14070]: FTP session closed
Apr 22 02:16:58 GFTS ftpd[14071]: FTP session closed
Apr 22 02:17:28 GFTS ftpd[14076]: FTP session closed
Apr 22 02:17:43 GFTS ftpd[14077]: FTP session closed
Apr 22 02:18:13 GFTS ftpd[14083]: FTP session closed
Apr 22 02:18:29 GFTS ftpd[14084]: FTP session closed
Apr 22 02:18:58 GFTS ftpd[14085]: FTP session close

[James R. Ferguson]

Hi:

You appear to have enabled logging for the 'ftpd' daemon. Logging is enabled by adding the '-l' argument to the 'ftpd' daemon when it is spawned by 'inetd'. Your '/etc/inetd.conf' file will contain a specification something like this:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

Eliminate the '-l' from the line above and restart 'inetd' thusly:

# /usr/sbin/inetd -c

Regards!

...JRF...

[James R. Ferguson]

Hi (again):

In addition, you may have other ftp commands being logged that you want to suppress. These would be armed with the '-L' argument for the ftp daemon as I described above. See the 'ftpd(1M)' man pages for more information.

Regards!

...JRF...

[Helen French · Accepted solution]

To trace down, you could probably observe the ftp connection from your clients. You will be able to find the IP addresses and other network related details from netstat command. Check the output and find out the client or process which is trying to do ftp. Also, check if any cron process setup.

Now, if you donot want any ftp access to be logged on the syslog, then you can use the -l option with ftpd daemon on /etc/inetd.conf file. I wouldn't do this since it's a security risk.

[Bill Douglass]

You can also use the ftpaccess file to control logging of commands and/or file transfers.

Tjis lets you break logging down into real, guest and anonymous users (the log you posted looks like it came from an ftp monitoring engine, so eliminating anonymous ftp logging might fix your problem).

See the ftpaccess and ftpd man pages, esp. "log commands" and "log transfers" inftpaccess.

[Tim Sanko]

Do you have "what's up" or
Solar Winds installed. Either one will produce a similar end result.

Solution: don't log or
grep -v "FTP session" syslog.log> tmpfile; cp tmpfile syslog.log

[Geoff Wild]

As an aside, to get them out of syslog.log, modify your /etc/syslog.conf file as follows:

mail.debug /var/adm/syslog/mail.log
daemon.info;mail.none /var/adm/syslog/daemon.log

Then restart syslogd

Rgds...Geoff

[Steven E. Protter]

For security reasons, you probably want the -l option enabled in inetd.conf

Its easy to turn off but that makes dealing with a ftp security issue that much harder after the fact.

So, I recommend leaving it on and making sure /var has enough space.

I have a weekly job to manage syslog on servers that don't get booted that often.

It does two things.

It copies off the old file with a date to the /backups filesystem. There is another cron job that cleans that up after 4 weeks.

The next step is to clean syslog.

> /var/adm/syslog/syslog.log

Solves the problem, maintains some level of auditing. Turning off the -l on the ftpd daemon has caused people to get written up in security audits.

The real long term answer is to stop using ftp at all. Here is the software and docs you need to start that long process.


Secure shell
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

A cookbook is attached.

Even more is my general security product list, which is way beyond the scope of your question, but I'm on a roll.

Bastille Security hardening
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

Perl which the above needs.
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=PERL

Security Patch Check
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6834AA

TCP Wrappers

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=TCPWRAP

IDS/9000 (Intrusion Detection Sytstem)

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA


SEP

[Michael Tully]

I was actually yesterday turning this stuff on, so to trace stuff coming in.

You may have these set up:
In your /etc/inetd.conf file you could have the entry for ftp as

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -lv

Remove the 'v' and 'l' if you are not satisfied. You may wish to check what your other systems have as well.
There is one further thing, in /etc/syslog.conf, have local5 removed if you have it.

If you make changes to either of these files, then run these, they will get the daemons to re-read current configs.

for inetd.conf
# inetd -c

for syslog.conf
# kill -HUP `cat /var/run/syslog.pid`

HTH
Michael

[Cheryl Griffin]

For each of these messages, is there an associated message that might say something else. Note the 14070 in this example, "ftpd[14070]: FTP session closed" is the PID. There may be some other error that needs correcting in addition to checking if logging is enabled.