hids, telnet and ftp

[feuillet]

Hi

I have just installing hids 3.1 on my server, but I would like to tracking the telnet and ftp connection.
How to make this?

thanks for all

[Pierre Pasturel · Accepted solution]

Hi -

What is the specific information you want to track?

HIDS does not monitor any telnet/ftp network traffic. HIDS monitors the btmp[s]/wtmp[s] and sulog files for both successful and repeated failed attempts to login and switch users (su), as well as logouts.

Depending on what you want to monitor, HIDS v4.0 can greatly reduce your alert volume as compared to V3.1, and is available at software.hp.com. I also recommend that you refer to the Administrator's Guide, especially Appendix A that describes all of HIDS detection capabilities.

All the URLs you need for HIDS can be found at http://www.hp.com/products1/unix/operating/hostids.html

I hope you find this helpful.

Pierre

[Ninad_1]

Hi,

You can log the ftp connections by specifying the various logging options available to ftpd - Pls see man ftpd.
You will require to modify the ftpd entry in /etc/intetd.conf accordingly and restart the inetd daemon by kill -HUP inetd
Am not too sure on the telnet logging.

Regards,
Ninad

[feuillet]

Thanks, I found the description in the apendix A of the manual.

So it is not possible to track the ftp and telnet with hids but hids monitor the change of log file...that can help.

Personaly, I will be satisfied with the log file of vsftp and syslog.

thanks Pierre for your help and the documentation.