ftpusers

[lastgreatone]

I would like to monitor closely ftp useage on the internet server. With anonymous ftp you see ip addresses. But with local users who have local accounts also use ftp clients (ie DreamWeaver). Because ftpd accesses local
accounts without using their login shells, I have no way of knowing who is making the connection. I just get Ftp session open, ftp session closed. If I understand correctly, if I add the users names in /etc/ftpusers, this will lock them out, which I don't want. Any workarounds that anyone may know of?

[James R. Ferguson · Accepted solution]

Hi Francoise:

You can increase the amount of information logged by adding the '-l' and '-v' options to the 'ftpd' daemon as startd by 'inetd'.

Add these flags to /etc/inetd.conf as:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -v

...and restart 'inetd' as:

# /usr/sbin/inetd -c

...JRF...

[Shannon Petry]

Even without the -l -v added to inetd.conf, you can always look into /var/adm/syslog/syslog.log.

syslog will show you who connected, failed login attempts, put/get commands and log out commands.

Simply
# grep FTPD /var/adm/syslog/syslog.log >> myfile.txt

then scan myfile.txt for users....

Regards,
Shannon

[lastgreatone]

No I don't get all information, since this is a web server and internet users connect as anonymous users to upload and local users use third party ftp clients, for editing, ie Dreamweaver. At the time I logged this message, that internet server for some reason just locked up on me from a remote administration location, so I went to the server room and even logging in at the console it took over a minute for the screen to pop up, this was a first for me and all I could see in the syslog was the usual anonymous ftp connections. Telecom people noted some socket errors but could not pinpoint the source. Maybe the ethernet card is showing signs of potential failure...