ftpd and sshd logging of domain names

Len Conrad LConrad at Go2France.com
Sun Aug 24 23:45:36 UTC 2008


> > with -ll, ftpd still logs failures as auth.log as
> > same in ftpd.log
> > [The IPs] they are not logged.
>
>I did the three steps I mentioned and have failures with IPs
>logged in /var/log/ftpd.log, for example:
>
>         connection from 79.165.190.70 (79.165.190.70)
>         FTP LOGIN FAILED FROM 79.165.190.70
>         FTP LOGIN FAILED FROM 79.165.190.70, Administrateur
>         repeated login failures from 79.165.190.70

... because the IP has no PTR

>         connection from projectvibe.net (205.234.98.200)
>         FTP LOGIN FAILED FROM projectvibe.net
>         FTP LOGIN FAILED FROM projectvibe.net, Administrator

IP has PTR, whose domain name is logged.

>But you're right, in the second example, the host name is logged,
>not the IP, but the IP is always logged in the "connection from"
>lines.

"connection from" not the fault we are trying to block reactively.

>Did you have any luck parsing the mailing list's archive?

no, neither in my personal archives, nor through google.

thanks
Len



More information about the freebsd-questions mailing list