ftpd don't record login in utmpx

Lowell Gilbert freebsd-security-local at be-well.ilk.org
Tue Mar 31 21:16:13 UTC 2015


Slawa Olhovchenkov <slw at zxy.spb.ru> writes:

> On Tue, Mar 31, 2015 at 12:28:04PM +0200, Willem Jan Withagen wrote:

>> Well that is only in your eyes. wtmp moved (on) to a different way of 
>> storing the data. At that point in time nobody had a problem with that. 
>> And in 5 years you are the first one to be vocal about it.
>
> All others still using old version?

No. Quite the opposite.

My guess is that this feature was *never* very widely used. All of the
information that it provides can be sent to the system logs instead. And
if you want more user-based information, many types are *only* availabe
on the system log. As a bonus, better management and analysis tools are
available for system log formats.

> I don't ask what I need do.
> I just ask why switch off logging.

FTP logging did not get turned off. FTP logging from inside of a chroot
to outside of a chroot got turned off.

As for why this happened, the answer is that the procedure you used to
use depended on a feature of wtmp. Eventually, wtmp was replaced by
utmpx to support unrelated new features. This meant that ftpd could no
longer modify wtmp files, because there no longer *are* any wtmp files.

As a final note, I'll point out that in principle, it's possible to
implement this feature in a more reasonable way. That involves having a
separate privileged task to handle closing sessions. Some alternative
FTP daemons are able to do this, but they generally suggest turning it
off because it increases resource usage by quite a bit.


More information about the freebsd-security mailing list