Subject: [977] Re: [971] log users` id or machine's id

From: [email-masked] (David Sears)
Date: Thu, 22 Dec 1994 10:16:58 -0700 (MST)

We *wrap* the wu-ftpd with tcpwrappers.  The tcpwrappers package gives
us great logging and access control capabilities.  System is a Sun4m 
running SunOS 4.1.3.

In the /etc/inetd.conf file:

###TCP_Wrappers
ftp  stream  tcp     nowait  root    /usr/etc/tcpd   ftpd -a -l

In the /etc/syslog.conf file:

##Added 26-Oct-1993 dms - tcp_wrappers program from CERT
local0.info	/var/adm/tcpwrappers

The messages from tcpwrappers will be logged to the file /var/adm/tcpwrappers.
(Don't forget the tab between the two fields in the syslog.conf file, create 
the file /var/adm/tcpwrappers, and restart syslog)

Logged message will resemble something like the following:

Dec 21 14:32:31 moat ftpd[9220]: connect from sair028b.engsci.sandia.gov

Additionally, the tcpwrappers package can be configured with access control 
lists to allow/deny certain hosts.  That is handled via the /etc/hosts.allow
and /etc/hosts.deny files.

Grab tcpwrapper, via anonymous ftp, from 

	cert.org:/pub/tools/tcp_wrappers

Good luck!

David Sears
Sandia National Labs
Dept 1511, Mail Stop 0827
Albuquerque, New Mexico  87185
U.S.A
Voice:	505-844-5729
Fax:	505-844-8251
E-Mail:	[email-masked]

> 
> From: David Zhang <[email-masked]>
> 
> 
> Right now, we set up the ftp log and it works fine. But, we like to
> know how to log where anonymous ftp comes from if the anonymous user
> doesn't provide his or her true email address as the required password.
>  
> Thank you in advance for help.
>  
> David Zhang
> Aimnet Corp.
> [email-masked]
>

---

From: David Zhang <[email-masked]>
Date: Thu, 22 Dec 1994 16:11:20 -0800

> Why not put an
> passwd-check rfc822 enforce
> in your ftpaccess ?
> (so if you don't enter a valid e-mail address you are logged out)
> 
> - Stefan.
> 

Yes, we have it in our ftpaccess. However, if somebody ftp into
our site as anonymous user and type the password, ie. [email-masked],
then get into our ftp machine. Currently, we are using wu-ftpd2.4(1).
Should we use 2.4(3) or something else? or something I didn't 
set up correctly? Thank you,

In addition, we also have tcpwrapper. I know that tcpwrapper can log
the in.tfpd from particular site. But, the wrapper cannot help us to 
trace who was trying to ftp our site with the password of [email-masked].

Thank you for your help. Also thank David Sears for the suggestion
of tcpwrapper.

David Zhang
Aimnet Corp.
[email-masked]