Last week, I wrote asking about logging incoming ftp sessions.
Basically, I received three kinds of answers:
o Get another 'ftpd' (several were suggested; see below);
o Turn on debugging with my current 'ftpd'.
o Please tell me what you find out.
Several people suggested the recently announced 'beta' version of 'ftpd'
from wuarchive.wustl.edu in /packages/ftpd.wuarchive.shar. This is
Chris Meyers' package.
A couple of others indicated that they'd modified 'ftpd' to do logging:
mrp@ucs.adelaide.edu.au has pub/4.3/ftpd-sirius.tar.Z on
ftp.adelaide.edu.au
Piete.Brooks@cl.cam.ac.uk says he's done one, but doesn't specify if
it's available.
syd@dsi.com mentioned one he'd gotten from Finland, but also didn't
give specifics on its availability.
Finally, jmcarli@srv.PacBell.COM suggested:
>In inetd.conf, make sure the ftp line is:
>ftp stream tcp nowait root /usr/etc/in.ftpd in.ftpd -ld
>
>(you need the 'd' (debug) to log everything.
>
>WARNING: This logs passwords also so make sure the /var/log/daemon
>(or whatever syslog.conf logs to will not be readable to the public!!! :-(
>
>My syslog.conf entry for logging is:
>
>daemon.debug ifdef(`LOGHOST', /var/log/daemon, @loghost)
Thanks to all who replied:
syd@dsinc.dsi.com (Syd Weinstein)
jmcarli@srv.PacBell.COM (Jerry M. Carlin)
Edward Vielmetti <emv@ox.com>
Mark Prior <mrp@ucs.adelaide.edu.au>
Piete.Brooks@cl.cam.ac.uk Fri Sep 27 07:04:26 1991
Frank Kuiper <frankk@cwi.nl>
pjw@math30 (Peter J. Welcher (math FACULTY) <pjw@math30>)
brw@hertz.njit.edu (Brian White)
Ted Rodriguez-Bell <ted@borgil.uchicago.edu>
--
INTERNET tkevans@ssa.gov UUCP ...!{rutgers|ames|uunet}!mimsy!woodb!tkevans
cc:Mail Tim K. Evans at ~OSS HHSMAIL CFSAN_GATE: *tkevans@ssa.gov
US MAIL 6401 Security Blvd, 2-Q-2 Operations, Baltimore, MD 21235
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:06:18 CDT