Clovertech

ftpd – identifying who the sending client is?????

› Clovertech Forums › Cloverleaf › ftpd – identifying who the sending client is?????

  • Creator
    Topic
  • January 18, 2021 at 2:35 pm #118394
    Bob Schmid
    Participant

      Anybody done the above???

       

      somebody coming into aix as client -> Cloverleaf server…invalid password

       

      Were looking at how to config ftpd so that the http://ftp.log or et.al…….might say it’s this ip sending to ya

      Thanks folks

    • Creator
      Topic
    Viewing 4 reply threads
    • Author
      Replies
      • January 18, 2021 at 11:34 pm #118402
        Charlie Bursell
        Participant

          What OS and what ftpd?

        • January 19, 2021 at 10:44 am #118406
          Bob Schmid
          Participant

            AIX   ftp server (ftpd)

             

            http://ftp.log Log looks like tis

            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: command: USER hci^M
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: <— 331
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: Password required for hci
            .
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: command: PASS
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: <— 530
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: Login incorrect.
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: command: QUIT^M
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: <— 221
            Jan 19 10:43:01 u111t0002 daemon:debug ftpd[4981454]: Goodbye.
            (END)

          • January 19, 2021 at 10:51 pm #118408
            Charlie Bursell
            Participant

              Bob:

              Linux has the ftpwho command.  I am not sure of AIX equivalent, if any.  However I have seen a Linux toolbox available for AIX which, I think, includes the ftpwho command.

            • January 21, 2021 at 3:46 pm #118412
              Rob Abbott
              Keymaster

                How often does this occur?  You might stand up an iptrace on the ftp port, that will certainly tell you where the traffic is coming from.

                Rob Abbott
                Cloverleaf Emeritus

              • February 17, 2021 at 2:50 pm #118507
                Bob Schmid
                Participant

                  Thanks Rob

                   

                   

                  coming from localhost 🙂

                   

                  found it

                   

              • Author
                Replies
              Viewing 4 reply threads
              • You must be logged in to reply to this topic.