Subject: syslog logging of connections

From: Tony Warner <[email-masked]>
Date: Fri, 26 Feb 1999 10:07:10 -0800

Hi there,

I've just installed wu-ftpd2.4.2[beta 18][VR 13] on a Digital (Compaq) Alpha
running Tru64 Unix 4.0d (Digital Unix 4.0d)  (These name changes are killing
me!)

Everything seems to be working ok so far, except for one thing.  The standard
ftpd that comes with all my systems (HP, Digital, SGI), when used with the -l
option, logs all connections to the ftp server.  It logs the name of the
initiating
host even before a login attempt is made.  This is a good thing for me, as
I can
see when probes are being conducted on my ftp ports and from where.
I can't seem to get wu-ftpd to do this.  I've tried the -l option, and it
only logs
anything once a user completes a login attempt.  Only then will it log
where the
user is connecting from.  I've tried using the logging commands in ftpaccess,
and they work fine for what they are for, but still no initial connection
logging.

my log lines in ftpaccess are:

log commands real,guest
log transfers anonymous,real,guest inbound,outbound
log security anonymous,guest,real

I've tried various combinations of these, including not using them at all
with the -l
option in place.  Still , no joy.

Any help?

Tony Warner

*********************************************************************
Tony Warner						[email-masked]
General Atomics					(619) 455-4285

*********************************************************************

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 26 Feb 1999 13:54:05 -0500 (EST)

On Fri, 26 Feb 1999, Tony Warner wrote:

> Everything seems to be working ok so far, except for one thing.  The
> standard ftpd that comes with all my systems (HP, Digital, SGI), when
> used with the -l option, logs all connections to the ftp server.  It
> logs the name of the initiating host even before a login attempt is
> made.  This is a good thing for me, as I can see when probes are being
> conducted on my ftp ports and from where. I can't seem to get wu-ftpd
> to do this.  I've tried the -l option, and it only logs anything once
> a user completes a login attempt.  Only then will it log where the
> user is connecting from.  I've tried using the logging commands in
> ftpaccess, and they work fine for what they are for, but still no
> initial connection logging.

Traditionally, WU-FTPD relies upon tcpwrappers to log this information.  
If you're using inetd, you should use tcpwrappers.

For better security, I recommend running xinetd instead of inetd.  xinetd
will log this information prior to passing control to the daemon without
the need for tcpwrappers.

When running VR13 in standalone daemon mode, the connection log you're
looking for should appear.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195