logging ftp session information

[Khashru]

I want to enable details ftp login in my hpus 11i server. I need ip of the machine who is doing the ftp.

[Khashru]

I have added -lv in inetd.conf. but it is only giving me ip address when a ftp session is ok. I need to find out Ip address for unsuccessful login.

[rariasn]

Hi Khashru,

Modify /etc/inetd.conf file:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -a -l -i -o -u002

# inetd -c

# man ftpd

# more /var/adm/syslog/xferlog

rgs,

[rariasn]

Sorry,

and

# grep ftp /var/adm/syslog/syslog.log

rgs,

[Khashru]

That will give me information about successful login. I need Ip address if a login fails.

[Bill Hassell]

ftpd does not 'login' so there is no record of failed attempts to gain access. ftpd uses PAM to authenticate but there is no login process run.

[Khashru]

I am getting message in syslog that someone is using one user name to do a ftp and rejected. I need to find out from which machine it is happening.

[Vasu Viswanadha]

Hi,

Normally FTP logs IP addresses on the syslog. Can you pls post the syslog o/p ?

They read some thing like this

[IP Addrss ] username .....




BR

Vasu

[Bill Hassell]

I have ftp configured in /etc/inetd.conf with just the -a option and if a user fails to login correctly, the following message is recorded for each failed attempt:

...mycpu ftpd[18496]: REPEATED LOGIN FAILURES FROM some-domain-or-IP

Be sure that your /etc/ftp/ftpaccess file has configured logging:

loginfails 2
log commands real
log transfers anonymous,real inbound,outbound

[Alpha977]

Hello!

I usually use the packet sniffer (like ethereal) and follow the TCP stream of the ftp packets.
Is good for software debug.

regards

[wien lam]

not sure about hpus, but on solaris10 my failed attempts show as

dmesg
Dec 28 20:47:13 host01 ftpd[8485]: [ID 265846 daemon.notice] repeated login failures from 172.20.1.2 [172.20.1.2]

or for that days logs
more /var/adm/messages
Dec 28 20:47:13 host01 ftpd[8485]: [ID 265846 daemon.notice] repeated login fail
ures from 172.20.1.2 [172.20.1.2]

you should be able to grep search them

Hope this answers your question, thanks
Wien lam