search

nikwrt / snake-os

Automatically exported from code.google.com/p/snake-os
0 stars 0 forks source link

Logging of FTP server? #166

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
Is there any way to see/create a log-file for the included FTP server?
I'd really like to see who is logging in and what the user is doing on FTP. Is 
there a log somewhere to be found or can I enable it?

Original issue reported on code.google.com by germanps...@gmail.com on 18 Jun 2011 at 12:14

GoogleCodeExporter commented 9 years ago 
It is possible to do: Connect through ssh, go to /etc  and there edit 
vsftp.conf file.

http://www.centos.org/docs/4/html/rhel-rg-en-4/s1-ftp-vsftpd-conf.html

On mine I added at the end of file:

dual_log_enable=NO
syslog_enable=NO
xferlog_enable=YES
xferlog_std_format=NO
vsftpd_log_file=/usb/sda1/log/vsftpd.log
xferlog_file=/usb/sda1/log/xferlog.log
log_ftp_protocol=YES

And in the directory:
# ls -lh
-rwxrwxrwx    1 root     root        1.3K Sep 11 19:29 vsftpd.log
-rwxrwxrwx    1 root     root           0 Sep 11 19:14 xferlog.log
# ls -lh
-rwxrwxrwx    1 root     root        1.3K Sep 11 19:29 vsftpd.log
-rwxrwxrwx    1 root     root           0 Sep 11 19:14 xferlog.log
# cat vsftpd.log 
Tue Sep 11 19:29:07 2012 [pid 27755] CONNECT: Client "ip-hidden"
Tue Sep 11 19:29:07 2012 [pid 27755] FTP response: Client "ip-hidden", "220 
Welcome to this FTP server"
Tue Sep 11 19:29:07 2012 [pid 27755] FTP command: Client "ip-hidden", "USER 
anonymous"
Tue Sep 11 19:29:07 2012 [pid 27755] [anonymous] FTP response: Client 
"ip-hidden", "331 Please specify the password."
Tue Sep 11 19:29:07 2012 [pid 27755] [anonymous] FTP command: Client 
"ip-hidden", "PASS <password>"
Tue Sep 11 19:29:07 2012 [pid 27754] [anonymous] FAIL LOGIN: Client "ip-hidden"
Tue Sep 11 19:29:08 2012 [pid 27755] [anonymous] FTP response: Client 
"ip-hidden", "530 Login incorrect."
Tue Sep 11 19:29:09 2012 [pid 27757] CONNECT: Client "ip-hidden"
Tue Sep 11 19:29:09 2012 [pid 27757] FTP response: Client "ip-hidden", "220 
Welcome to this FTP server"
Tue Sep 11 19:29:12 2012 [pid 27757] FTP command: Client "ip-hidden", "USER 
help"
Tue Sep 11 19:29:12 2012 [pid 27757] [help] FTP response: Client "ip-hidden", 
"331 Please specify the password."
Tue Sep 11 19:29:12 2012 [pid 27757] [help] FTP command: Client "ip-hidden", 
"PASS <password>"
Tue Sep 11 19:29:12 2012 [pid 27756] [help] FAIL LOGIN: Client "ip-hidden"
Tue Sep 11 19:29:13 2012 [pid 27757] [help] FTP response: Client "ip-hidden", 
"530 Login incorrect."
#

Original comment by pepe.j...@gmail.com on 11 Sep 2012 at 5:36