From owner-freebsd-questions@FreeBSD.ORG  Sun Aug 24 22:47:27 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7E9641065678
	for <freebsd-questions@freebsd.org>;
	Sun, 24 Aug 2008 22:47:27 +0000 (UTC)
	(envelope-from freebsd@edvax.de)
Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14])
	by mx1.freebsd.org (Postfix) with ESMTP id 5950A8FC12
	for <freebsd-questions@freebsd.org>;
	Sun, 24 Aug 2008 22:47:27 +0000 (UTC)
	(envelope-from freebsd@edvax.de)
Received: from r55.edvax.de (port-92-195-21-147.dynamic.qsc.de [92.195.21.147])
	by mx02.qsc.de (Postfix) with ESMTP id 0AA4219B7CBB;
	Mon, 25 Aug 2008 00:47:25 +0200 (CEST)
Received: from r55.edvax.de (localhost [127.0.0.1])
	by r55.edvax.de (8.14.2/8.14.2) with SMTP id m7OMlOfw002449;
	Mon, 25 Aug 2008 00:47:24 +0200 (CEST)
	(envelope-from freebsd@edvax.de)
Date: Mon, 25 Aug 2008 00:47:24 +0200
From: Polytropon <freebsd@edvax.de>
To: Len Conrad <LConrad@Go2France.com>
Message-Id: <20080825004724.ca193745.freebsd@edvax.de>
In-Reply-To: <200808250011937.SM01744@TX2.Go2France.com>
References: <200808242325843.SM01744@TX2.Go2France.com>
	<20080824234412.c4356260.freebsd@edvax.de>
	<200808250011937.SM01744@TX2.Go2France.com>
Organization: EDVAX
X-Mailer: Sylpheed 2.4.7 (GTK+ 2.12.1; i386-portbld-freebsd7.0)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: ftpd and sshd logging of domain names
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Polytropon <freebsd@edvax.de>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 24 Aug 2008 22:47:27 -0000

On Sun, 24 Aug 2008 17:18:55 -0500, Len Conrad <LConrad@Go2France.com> wrote:
> with -ll, ftpd still logs failures as auth.log as
> same in ftpd.log
> [The IPs] they are not logged.

I did the three steps I mentioned and have failures with IPs
logged in /var/log/ftpd.log, for example:

	connection from 79.165.190.70 (79.165.190.70)
	FTP LOGIN FAILED FROM 79.165.190.70
	FTP LOGIN FAILED FROM 79.165.190.70, Administrateur
	repeated login failures from 79.165.190.70

	connection from projectvibe.net (205.234.98.200)
	FTP LOGIN FAILED FROM projectvibe.net
	FTP LOGIN FAILED FROM projectvibe.net, Administrator

But you're right, in the second example, the host name is logged,
not the IP, but the IP is always logged in the "connection from"
lines.

Did you have any luck parsing the mailing list's archive?

-- 
Polytropon
>From Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...