Subject: Re: Faq doesnt help much

From: [email-masked] (Richard Fancher)
Date: Sat, 07 Dec 1996 11:16:07 -0800

At 07:22 PM 12/6/96 +0000, you wrote:
>On Fri, 6 Dec 1996, Richard Fancher wrote:
>
>> I have read the faq..i have read the man...i cant find how to tell who is
>> on the ftpd..can anyone help??
>
>Hi, 
>  I'm still new at this but I copied the ftpaccess/active-server sample
>included with the source to my /etc and only then ftpwho and ftpcount
>works. Hope it somewhat helps.
>
>Ahmad
>
Hmm i looked for active-server....i cant find it at all..where is it??

===============================================
= Windjammer Communications, LLC              =
= 2100 21st Sacramento CA 95818               =
= TEL: (916) 454-2114                         =
= FAX: (916) 454-2121                         =
= Richard Fancher (Sys-Admin)                 =
= [email-masked]                         =
= http://www.windjammer.net                   =
===============================================

---

From: Chuck Davis <[email-masked]>
Date: Mon, 09 Dec 1996 13:18:41 EST

Well I'll put in my two cents worth now...

In addition to checking syslog and the wu-ftpd xferlog for connections I
made a couple of changes to the ftpd.c source.  These changes allow me to
type ps -ef (-aux or whatever on your system to show all processes) and
then pipe to grep and search for the string 'ftp'.  Any current ftp
connections show up like this:

root 25139   607  0 12:38:14 ?  0:00 wuftpd eos.nasa.gov: cdavis: IDLE

If there are anon connections or file xfers underway these, along w/ file
names are shown.  It is very convenient for us here as some transfer take
several hours and we don't always know it they are done or if they are
hung.

The changes I made are:

in ftpd.c (around line 1202):

	#ifdef SETPROCTITLE
	       	 sprintf(proctitle, "wuftpd %s: anonymous/%.*s", remotehost,
	       	             sizeof(proctitle) - sizeof(remotehost) -
	       	             sizeof(": anonymous/"), passwd);
	       	 setproctitle("%s", proctitle);
	#endif /* SETPROCTITLE */

(about line 1214):

	#ifdef SETPROCTITLE
	        sprintf(proctitle, "wuftpd %s: %s", remotehost, pw->pw_name);
	        setproctitle(proctitle);
	#endif /* SETPROCTITLE */

Note the "wuftp" text as the first part of the proc string.  You could make
it read your favorite color or food if that suits you better.

In order for these change to show up you need to "#define SETPROCTITLE" in
the config.h file.  I've heard some folks say that setproctitle function is
flaky but I've had no real problems with it.  This is how ftpd worked on my
server before I installed wu-ftpd.  It may not be for everybody but I like
it...

Also, I think (I can't remember if it was already there or not - I deleted
the original sources) I modified the following line in ftpd.c (line 1109)
so that 'last' would log the remote host name:

	    logwtmp(ttyline, pw->pw_name, remotehost);

This is helpful for me since I am mostly concerned w/ connections coming
from outside our domain and this is an easy way to view them.

Regards,

Chuck Davis
UNIX/NT Sys Admin
Walter Reed Army Inst. of Research
 
------------------

> Well w or who or finger doesn't show ftp ports on my machine, so I use
> last for that.  I also have a /var/adm/SYSLOG file (on sgi machines) other
> machines it's usually var/adm/messages /usr/adm/messages. You could do a
> tail -f on the file and see who is logged into ftpd.
> 
> root@galactus:/var/adm# tail -f SYSLOG
> Dec  6 19:00:14 6D:galactus ftpd[25229]: connection from KXS242.rh.psu.edu
> [128.118.208.165]
> Dec  6 19:00:16 6D:galactus ftpd[25229]: USER anonymous
> Dec  6 19:00:24 6D:galactus ftpd[25229]: PASS xxxxxxxxxx
> Dec  6 19:00:25 6D:galactus ftpd[25229]: ANONYMOUS FTP LOGIN FROM  
> rh.psu.edu [128.118.208.165], xxxxxxxxxx
> 
> 
> Regards,
> Dan Woodard, TIAC Systems Administrator
> 
> > At 02:32 PM 12/6/96 -0500, you wrote:
> > >You can use the last command. ie
> > >
> > ># last | grep still
> > >iqsystem ftp26405                           Fri Dec  6 14:24   still 
> > >logged in
> > >dkaufman ftp25581                           Fri Dec  6 14:13   still
> > >logged in
> > >#
> > >
> > Umm sorry but you can get that same info from w or who or finger due to you
> > are querying from the login ports...NOT who is logged into the ftpd.
> > 
> > 
> > 
> >