inetd.conf and ftpaccess

[Brett Askinazi]

I have 2 issues.

Issue 1: Guest accounts FTP were not being logged into the xferlog.

Issue 2: Some files that were FTPed into the system were truncated.

I did 2 things to fix this;
in inetd i did the following (to fix issue 2)
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -P -a

in ftpaccess i did the following (to fix issue 1)
log commands real,anonymous,guest
log transfer anonymous,guest,real inbound,outbound

After the changes were complete i did
inetd -c

Before real,anonymous users were being logged. Currently (post changes) nothing is getting logged, what did I do wrong? Only time will tell on the truncation problem... but i need to get logging re-enabled ...

[Scott Van Kalken]

you need to add a -i to inetd.conf to enable to use of /var/adm/syslog/xferlog.


You're right though, the -a does enable the use of the ftpaccess file.


my inetd.conf file looks like this:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -lvio -u077

-l = logs to syslog
-v = verbose (debug)
-i = log transferred files to xferlog (received files)
-o = log transferred files to xferlog (outgoing files)

-i = inbound
-o = outbound

that's how I remember it.

Scott.

[Scott Van Kalken]

oops - i forgot...

-u sets umask on transferred files.

I like to log this stuff so I can tell which idiots delete files using ftp.

I'm trying to figure out a way using the ftp access file to allow them to drop files (write) but not delete anything that's there currently.

I'll get around to looking at it again one day.

:)

Hope this helps

Scott.

[S.K. Chan]

This is only for 11.x

At HP-UX 11.00 ftpd messages are written to syslogd with a facility of "local5" and a level of "debug". By default syslogd does
not capture messages with a level of "debug". To log these messages do the following:

o Add the following line to /etc/syslog.conf:

local5.debug /var/adm/syslog/syslog.log

NOTE: Be careful to use tab as a field delimeter and not spaces.

o Run the following to make syslogd read the configuration changes:

kill -HUP `cat /var/run/syslog.pid`

ftpd messages should now be logged to /var/adm/syslog.log

[Scott Van Kalken]

Yup, you're right S.K.

I keep forgetting it's 11x only.

We only have two 10.20 machines here and they're REALLY old.

(one of them is an E55).

[Brett Askinazi]

The syslog.log has always been ok.

I am looking for xferlog, for all of the detail that it provides.

ftpd says that ftpaccess overrides all logging options on the ftpd commandline.

Any thoughts on that ?

[Scott Van Kalken]

the -i and -o options for ftpd will do this.

[Brett Askinazi]

I should have mentioned in that last post that the -i -o options didnt work either.

I think ftpaccess needs to be modified in some way.

[Bill Hassell]

Most of the features of ftpaccess, etc are part of the WU_ftpd package which is supplied as a patch for 11.0 only (std in 11i). To match these features at 10.20, you'll need to get a copy of WU_ftpd from the Liverpool Porting Centre: http://hpux.connect.org.uk/

[Brett Askinazi]

I also forgot to add that I am running, HP UX 11.0

How can I tell if wuftpd is installed or the daemon that ships?

[James R. Ferguson]

Hi Brett:

The Washington University code appeared for 11.0 during 1998 and would be part of later copies. The 'xferlog' facility is one of its features. Patch PHNE_23949 is the latest 'ftpd' patch.

Regards!

...JRF...