Subject: logging anonymous users

From: Sean S Coleman 303-497-5672 <[email-masked]>
Date: Tue, 17 Jun 1997 22:26:18 -0600 (MDT)

I want to log each anonymous ftp login via syslog to keep track
of ftp access. I configured inetd.conf such that ftpd runs with 
the flags -a and -l. Based on the information in the ftpd man page 
and from a quick look at the code, these settings should be enough to
get the connection information into my log files. The particular entry
I want is:

 ANONYMOUS FTP LOGIN FROM tahoe [132.163.129.
 121], [email-masked]

Unfortuantly, the only way I can get this information logged is to 
enable command logging in the ftpacces file. I added  a syslog() call
right after setting logging=1 in the ftpd.c while processing the
options. When I added the syslog call and took out the log command in
the ftpaccess file, I was able to get the above entry but when I removed
the syslog() call which I added, I could no longer get ftpd to log
connections.

I am running beta 13 on a Solaris 2.5 system. Is there a solution to
this problem or is this a bug in the software?

Your help will be appreciated because I am getting frustrated trying
to get this to work.

Thanks

Sean Coleman
NIST
Boulder, CO
.

---

From: "Philip Kearney III" <[email-masked]>
Date: Wed, 18 Jun 1997 01:38:56 -0400

> I want to log each anonymous ftp login via syslog to keep track of ftp 
> access. I configured inetd.conf such that ftpd runs with the flags -a 
> and -l. Based on the information in the ftpd man page and from a quick 
> look at the code, these settings should be enough to get the connection 
> information into my log files. The particular entry I want is: 
>  
>  ANONYMOUS FTP LOGIN FROM tahoe [132.163.129. 121], coleman@
>  boulder.nist.tof 
>  
> Unfortuantly, the only way I can get this information logged is to enable 
> command logging in the ftpacces file. I added  a syslog() call right 
> after setting logging=1 in the ftpd.c while processing the options. When 
> I added the syslog call and took out the log command in the ftpaccess 
> file, I was able to get the above entry but when I removed the syslog() 
> call which I added, I could no longer get ftpd to log connections. 

I had to do the same thing, except I wanted have the ability to log the 
address of every user who logged in anonymous or not as well as just anonymous 
users.

Here's what I did:

Added the following to config.h:

Right before the #define for LOG_FAILED, I added:

/*
 * log ALL login attempts. You may want this to be off if you have a
 * busy server because the log gets big and it puts a strain on syslog.
 */

#define LOG_ALL_LOGINS

/*
 * log ALL ANONYMOUS login attempts. You may want this to be off if you 
 * have a busy server because the log gets big and it puts a strain 
 * on syslog.
 */

#ifndef LOG_ALL_LOGINS

#define LOG_ALL_ANON_LOGINS

#endif

And then in ftpd.c, right at the top of the user() function I put:

user(char *name)
{
    register char *cp;
    char *shell;
    char *getusershell();
    int   why = 0;

#ifdef LOG_ALL_LOGINS    /* 11-Jun-97 PFK - Log ALL login attempts */

    syslog(LOG_INFO, "Login attempt from: %s [%s]", remotehost, remoteaddr);

#endif

.
.
.

    if (!strcasecmp(name, "ftp") || !strcasecmp(name, "anonymous")) {
      struct aclmember *entry = NULL;
      int machineok=1;
      char guestservername[MAXHOSTNAMELEN];
      guestservername[0]='\0';

#ifndef LOG_ALL_LOGINS    /* 11-Jun-97 PFK - Log ALL login attempts */

#ifdef LOG_ALL_ANON_LOGINS /* 11-Jun-97 PFK - Log ALL ANON login attempts */

    syslog(LOG_INFO, "ANONYMOUS Login attempt from: %s [%s]", remotehost,
           remoteaddr);
#endif

#endif

	.
	.
	.
    }
.
.
.

}

Then you get a log that looks like this:

Jun 18 00:44:34 valhalla ftpd[16792]: Login attempt from: 
mctnts07c11.nbnet.nb.ca [207.179.134.113]
Jun 18 00:44:34 valhalla ftpd[16792]: USER anonymous
Jun 18 00:44:34 valhalla ftpd[16792]: PASS [email-masked]
Jun 18 00:44:39 valhalla ftpd[16792]: FTP session closed

If this is a feature that you want, I suggest you send e-mail to wu-ftpd-
[email-masked] and ask them for it.  I did.  I said I wanted one for logging 
all logins of anonymous users as well as logins of all users.

I like having them in the syslog so I can just copy the relevant portion of 
the log from connection to session close if someone is messing around on my 
server.  You can send it to the ISP and say here's where they connected, 
here's what they did and here's where they logged off.

All I did was assign one of the local syslogs, like local0 or local1 to be 
"syslog.ftp" and all FTP logging goes into that syslog file.

Hope this helps.

-phil

----------------------------------------------------------------------------
Philip Kearney III                mailto:[email-masked] 
Sr. Software Engineer             mailto:[email-masked]
System Administrator              finger [email-masked] for my PGP key
Ascend Communications, Inc.       
Client Software Engineering Group             
----------------------------------------------------------------------------