rexecd logging

[Mark Killen]

I need to know how to log who is running rexec from one server to the other. There are no .rhosts files so the must be manulally enterning the password. I believe that it is scripted as we are seeing LOGIN OK multiple times in the syslog within seconds of each other. I know I can block it all together and setup for individual use but I want to know who is running the scripts.
Thanks

[harry d brown jr]

Mark,

You need to turn on inetd LOGGING:

inetd -l

here's an example of the syslog entries:

May 29 09:50:13 vpart1 ftpd[13686]: FTP session closed
Jun 6 08:26:31 vpart1 inetd[1306]: Connection logging enabled
Jun 6 08:26:38 vpart1 inetd[27365]: exec/tcp: Connection from vpart3 (141.123.226.43) at Thu Jun 6 08:26:38 2002
#


Note the FTP line was the last line before I turned it on.

live free or die
harry

[harry d brown jr]

Mark,

Also, your SYSLOG will GROW like a weed, so you'll need to pay very close attention to the size more often.


live free or die
harry