From owner-freebsd-questions  Mon Apr  7 03:09:09 1997
Return-Path: <owner-questions>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id DAA05874
          for questions-outgoing; Mon, 7 Apr 1997 03:09:09 -0700 (PDT)
Received: from gatekeeper.barcode.co.il (gatekeeper.barcode.co.il [192.116.93.17])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id DAA05859
          for <freebsd-questions@freebsd.org>; Mon, 7 Apr 1997 03:08:57 -0700 (PDT)
Received: (from smap@localhost) by gatekeeper.barcode.co.il (8.8.5/8.6.12) id NAA20280; Mon, 7 Apr 1997 13:07:49 +0300 (IDT)
X-Authentication-Warning: gatekeeper.barcode.co.il: smap set sender to <nadav@barcode.co.il> using -f
Received: from localhost.barcode.co.il(127.0.0.1) by gatekeeper.barcode.co.il via smap (V1.3)
	id sma020277; Mon Apr  7 13:07:39 1997
Message-ID: <3348C747.7962@barcode.co.il>
Date: Mon, 07 Apr 1997 13:07:03 +0300
From: Nadav Eiron <nadav@barcode.co.il>
X-Mailer: Mozilla 3.0 (X11; I; SunOS 5.5 sun4m)
MIME-Version: 1.0
To: jadeite <jadeite@light.pomona.edu>
CC: freebsd-questions@freebsd.org
Subject: Re: loggin mail port
References: <Pine.BSF.3.95q.970405155105.466A-100000@light.pomona.edu>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

jadeite wrote:
> 
> Hi,
>         I'm trying to keep track of people logging into port 25.  I had
> syslog.conf report the following facilities:
> kern.*;lpr.*;mail.*;daemon.*;auth.* but I'm still not informed of telnets
> to port 25.  In fact the only clue I have is that when I do MAIL FROM: in
> smtp I'm told that /etc/aliases.db is out of date (I don't have such a
> file, only /etc/aliases, so this is could be an indication that I have
> another problem).  So, is there something in sendmail.cf that I need to
> configured so I'll know when someone telnets to port 25, or did I
> configure syslog.conf wrong?


I use TIS fwtk's smap/smapd and noticed it logs connections to the SMTP
port that does not actually send a message (something like: "QUIT
without DATA"). It is much more secure than sendmail, so you may want to
give it a try anyhow.

If you want to log *every* connection to the SMTP port, you can use ipfw
to do that.

Nadav