Logging FTP Request
Troy Edmonson
modified /etc/inetd.conf as follows:
ftp stream tcp nowait /etc/ftpd ftpd -Lio
I modified /etc/syslog.conf to include the following:
daemon.* /usr/adm/daemon.log
After restarting, and an ftp log session, nothing.
Help appreciated....
Troy
Sent via Deja.com http://www.deja.com/
Before you buy.
Bill Campbell
under tcp_wrappers. This will log all connections, and give you
considerable control over who is allowed to connect to the individual
services. It can also be configured to send alerts when anybody attempts
to connect to a service you don't want to allow which can give early
warning if somebody's attempting to crack the system (pay particular
attention to hits on imapd, and telnet).
--
Bill
--
INTERNET: bi...@Celestial.COM Bill Campbell; Celestial Systems, Inc.
UUCP: camco!bill PO Box 820; 6641 E. Mercer Way
FAX: (206) 232-9186 Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/
``We shouldn't elect a President; we should elect a magician.''
Will Rogers
Jean-Pierre Radley
| I'm having problems forcing syslogd to report ftp logging. I have
| modified /etc/inetd.conf as follows:
|
| ftp stream tcp nowait /etc/ftpd ftpd -Lio
|
| I modified /etc/syslog.conf to include the following:
|
| daemon.* /usr/adm/daemon.log
|
| After restarting, and an ftp log session, nothing.
|
I have no idea which syslog facility ftpd is using, but I very much
suspect it is not 'daemon'.
Wu-ftpd is shipped to compile with 'user' as the default facility, and I
think SCO's ftpd is derived from a three-year old version of wu-ftpd, so
try 'user'.
(When I compile wu-ftpd, I change the facility to local7; that way, I can
direct ftpd messages to /usr/adm/ftplog, since syslog already looks
like the kitchen sink.)
Also look at technical article 107640.
--
JP
Roberto Zini
>
> I'm having problems forcing syslogd to report ftp logging. I have
> modified /etc/inetd.conf as follows:
>
> ftp stream tcp nowait /etc/ftpd ftpd -Lio
You forgot the 'user' item in the above line; also, I've added
the '-u 022 -t 300' switches to the ftpd ones :
ftp stream tcp nowait root /etc/ftpd ftpd -Lio -u 022 -t 300
^^^^ ^^^^^^^^^^^^^
You could also use NOLUID instead of root as the 'user' field.
>
> I modified /etc/syslog.conf to include the following:
>
> daemon.* /usr/adm/daemon.log
Remember to use TABS between the 2 items.
>
> After restarting, and an ftp log session, nothing.
Did you signal (kill -HUP) syslogd ? Eg, 'kill -HUP <syslog.pid>'
where <syslog.pid> is the number stored into the /etc/syslog.pid
file.
>
> Help appreciated....
>
> Troy
Hope this helps !
Best,
Roberto
--
---------------------------------------------------------------------
Roberto Zini email : fr...@strhold.it
Technical Support Manager -- Strhold Sistemi EDP Reggio Emilia(ITALY)
---------------------------------------------------------------------
"Has anybody around here seen an aircraft carrier?"
(Pete "Maverick" Mitchell - Top Gun)
Tony Lawrence
>
> I'm having problems forcing syslogd to report ftp logging. I have
> modified /etc/inetd.conf as follows:
>
> ftp stream tcp nowait /etc/ftpd ftpd -Lio
I've never been able to get the "io" flags to work- all I've
ever seen is the login info- unless you turn on "d", in
which case you get EVERYTHING.
However, you can make file transfers work by using
/etc/ftpaccess- see man ftpaccess or just take a look at the
file; it's the "log transfers" line - they end up in
/var/adm/xferlog.
--
Tony Lawrence (to...@aplawrence.com)
SCO articles, help, book reviews, tests,
job listings and more : http://www.ApLawrence.com
Troy Edmonson
Here is my syslog.conf file:
*.info,*.debug[tab]/usr/adm/syslog
local0.notice[tab]/var/adm/syslog
daemon.*[tab]/usr/adm/daemon.log
The file /etc/inetd.conf is as follows:
ftp stream tcp nowait /etc/ftpd ftpd -Lio
Why not use xferlog as Tony suggest? Is there an advantage to using
the system log file? As Tony says, it does look like the kitchen
sink!
In article <38326432...@strhold.it>,
fr...@strhold.it wrote:
> Troy Edmonson wrote:
> >
> > I'm having problems forcing syslogd to report ftp logging. I have
> > modified /etc/inetd.conf as follows:
> >
> > ftp stream tcp nowait /etc/ftpd ftpd -Lio
>
> You forgot the 'user' item in the above line; also, I've added
> the '-u 022 -t 300' switches to the ftpd ones :
>
> ftp stream tcp nowait root /etc/ftpd ftpd -Lio -u 022 -t 300
> ^^^^ ^^^^^^^^^^^^^
>
> You could also use NOLUID instead of root as the 'user' field.
>
> >
> > I modified /etc/syslog.conf to include the following:
> >
> > daemon.* /usr/adm/daemon.log
>
> Remember to use TABS between the 2 items.
>
> >
> > After restarting, and an ftp log session, nothing.
>
> Did you signal (kill -HUP) syslogd ? Eg, 'kill -HUP <syslog.pid>'
> where <syslog.pid> is the number stored into the /etc/syslog.pid
> file.
>
> >
> > Help appreciated....
> >
> > Troy
>
> Hope this helps !
>
> Best,
> Roberto
>
> --
> ---------------------------------------------------------------------
> Roberto Zini email : fr...@strhold.it
> Technical Support Manager -- Strhold Sistemi EDP Reggio Emilia(ITALY)
> ---------------------------------------------------------------------
> "Has anybody around here seen an aircraft carrier?"
> (Pete "Maverick" Mitchell - Top Gun)
>
Scott Taylor
>
> Troy Edmonson wrote:
>
> > Why not use xferlog as Tony suggest? Is there an advantage to using
> > the system log file? As Tony says, it does look like the kitchen
> > sink!
>
> that syslog looks remarkably like my desk.. or even my whole
> office.
>
> Someday I'm going to take a picture of this incredible mess
> and post it on the web- though I think Jeff L. can outbid me
> on that, right Jeff? :-)
>
> A clean desk is a sign of a sick mind.
I always wondered why some people keep such clean desks. Now it all
starts to come together.
Everyday the boss comes by, looks around my cubby hole of an office and
asks, "what the hell do you do in here?" If only he could see it at
7:55 instead of 8:05 -- but, then he may think I'm not busy at all.
One time I had a programmer who's desk was immaculate. He was so proud
of it...so I gave him shit. Then I piled a bunch of old reports on it
in some strewn fashion and said, "there, now it looks like you are
busy. Keep up the good work."
--
Scott Taylor
MIS, MAAX Westco Inc.
Tony Lawrence
> Why not use xferlog as Tony suggest? Is there an advantage to using
> the system log file? As Tony says, it does look like the kitchen
> sink!
That was JPR who said "kitchen sink".. I would have said
that syslog looks remarkably like my desk.. or even my whole
office.
Someday I'm going to take a picture of this incredible mess
and post it on the web- though I think Jeff L. can outbid me
on that, right Jeff? :-)
A clean desk is a sign of a sick mind.
Bill Vermillion
>> Why not use xferlog as Tony suggest? Is there an advantage to using
>> the system log file? As Tony says, it does look like the kitchen
>> sink!
>That was JPR who said "kitchen sink".. I would have said
>that syslog looks remarkably like my desk.. or even my whole
>office.
>Someday I'm going to take a picture of this incredible mess
>and post it on the web- though I think Jeff L. can outbid me
>on that, right Jeff? :-)
I suspect he can. He has pictures on his web sites. I do work
for one place that could outdo Jeff's however. whuta mess
--
Bill Vermillion bv @ wjv.com