Trying to find IP address of server that locked account during ftp login.

[Joe Profaizer]

Is there a way to identify an IP address of the server that unsucessfully tried logging into our HPUX server and hence locked out the account. I have search syslog and other logs to no avail.

I guess I'm asking for an audit trail of unsucessful logins and also having the ability to identify the originating IP address or server that locked the respective account.

We're running HP-UX 11.11 on an L2000.

Thanks,

..Joe

[Steven E. Protter]

Shalom,

inetd -l

sets enhanced logging.

There may be a record of bad logins in /var/adm/syslog/btmp

lastb

Is the command that shows bad logins.

I don't recall if bad ftp logins log there.

SEP

[Jeff_Traigle]

If you have the -l option on ftpd in /etc/inetd.conf, it'll log to syslog. From there, you can see unsuccessful login attempts. It's typical in my experience that these types of problems occur because of cron jobs that have passwords in them. The password gets changed on the account and the script doesn't get updated so unsuccessful login attempts start piling up. The only way I've found to track down the server causing the problem is to watch for an occurrence in syslog. The PID of the ftpd associated with the rogue access attempt is shown there. Then, since ftpd takes a few seconds to time out from the unsuccessful login attempt, you can grep for the PID in the "ps -ef" output. (ps -ef | grep PID) The IP address making the connection is displayed there. A bit of a pain, but it works and it was the only way I found to track it down.

[Jeff Schussele]

Hi Joe,

Just start inetd with -l

/usr/sbin/inetd -l

HTH,
Jeff

[Patrick Wallek]

inetd logging doesn't do you much good after the fact.

You can try a 'lastb -R ' and see if the FTP logins show up.

[Sheriff Andy]

Our network admins did a network intrusion test on our network without our knowledge and it locked out some of our accounts.

Way we found out was by doing the lastb -R as suggested in the earlier post. You can grep for ftp as well.

Andy