ftpd and sshd logging of domain names
LConrad at Go2France.com
Sun Aug 24 23:45:36 UTC 2008
> > with -ll, ftpd still logs failures as auth.log as
> > same in ftpd.log
> > [The IPs] they are not logged.
>I did the three steps I mentioned and have failures with IPs
>logged in /var/log/ftpd.log, for example:
> connection from 126.96.36.199 (188.8.131.52)
> FTP LOGIN FAILED FROM 184.108.40.206
> FTP LOGIN FAILED FROM 220.127.116.11, Administrateur
> repeated login failures from 18.104.22.168
... because the IP has no PTR
> connection from projectvibe.net (22.214.171.124)
> FTP LOGIN FAILED FROM projectvibe.net
> FTP LOGIN FAILED FROM projectvibe.net, Administrator
IP has PTR, whose domain name is logged.
>But you're right, in the second example, the host name is logged,
>not the IP, but the IP is always logged in the "connection from"
"connection from" not the fault we are trying to block reactively.
>Did you have any luck parsing the mailing list's archive?
no, neither in my personal archives, nor through google.
More information about the freebsd-questions