This is a discussion on vsftpd within the Linux Security forums, part of the System Security and Security Related category; Might there be a way to get vsftpd to log "Permission denied" attempts as well as "Login ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
On Sat, 23 Aug 2003, Garrison wrote:
> Might there be a way to get vsftpd to log "Permission denied" attempts as > well as "Login incorrect" attempts? > > Permission denied = username is not allowed to log in > Login incorrect = good username, bad password > > -g Look for "authentication failure" and "user unknown" in your logfile > |
|
|||
|
On Sun, 24 Aug 2003 04:16:57 +0000, Whoever wrote:
>> Might there be a way to get vsftpd to log "Permission denied" attempts as >> well as "Login incorrect" attempts? >> >> Permission denied = username is not allowed to log in >> Login incorrect = good username, bad password > > Look for "authentication failure" and "user unknown" in your logfile There are no such entries for vsftpd, "Login incorrect" messages to the client yield "[user] FAIL LOGIN" messages in vsftpd.log If it was logging, I'd see it. |
|
|||
|
On Sun, 24 Aug 2003, Garrison wrote:
> On Sun, 24 Aug 2003 04:16:57 +0000, Whoever wrote: > > >> Might there be a way to get vsftpd to log "Permission denied" attempts as > >> well as "Login incorrect" attempts? > >> > >> Permission denied = username is not allowed to log in > >> Login incorrect = good username, bad password > > > > Look for "authentication failure" and "user unknown" in your logfile > > There are no such entries for vsftpd, "Login incorrect" messages to the > client yield "[user] FAIL LOGIN" messages in vsftpd.log > > If it was logging, I'd see it. I am using vsftpd on a gentoo system and I see the above messages (both) if an attempt is made to login with a non-existent username. Did you build vsftp with support for PAM? What logging do you have enabled in your vsftp.conf file? > |
|
|||
|
On Mon, 25 Aug 2003 04:02:01 +0000, Whoever wrote:
> I am using vsftpd on a gentoo system and I see the above messages (both) > if an attempt is made to login with a non-existent username. > > Did you build vsftp with support for PAM? What logging do you have enabled > in your vsftp.conf file? I see them now as well, but only by enabling log_ftp_protocol, which causes every message btw client/server to be logged. The man page doesn't seem to suggest that there is a level between the sparse logging I had and the debug logging I have. |