Date: Sun, 24 Aug 2008 18:44:51 -0500 From: Len Conrad <LConrad@Go2France.com> To: freebsd-questions@freebsd.org Subject: Re: ftpd and sshd logging of domain names Message-ID: <200808250137406.SM01744@TX2.Go2France.com> In-Reply-To: <20080825004724.ca193745.freebsd@edvax.de> References: <200808242325843.SM01744@TX2.Go2France.com> <20080824234412.c4356260.freebsd@edvax.de> <200808250011937.SM01744@TX2.Go2France.com> <20080825004724.ca193745.freebsd@edvax.de>
next in thread | previous in thread | raw e-mail | index | archive | help
> > with -ll, ftpd still logs failures as auth.log as > > same in ftpd.log > > [The IPs] they are not logged. > >I did the three steps I mentioned and have failures with IPs >logged in /var/log/ftpd.log, for example: > > connection from 79.165.190.70 (79.165.190.70) > FTP LOGIN FAILED FROM 79.165.190.70 > FTP LOGIN FAILED FROM 79.165.190.70, Administrateur > repeated login failures from 79.165.190.70 ... because the IP has no PTR > connection from projectvibe.net (205.234.98.200) > FTP LOGIN FAILED FROM projectvibe.net > FTP LOGIN FAILED FROM projectvibe.net, Administrator IP has PTR, whose domain name is logged. >But you're right, in the second example, the host name is logged, >not the IP, but the IP is always logged in the "connection from" >lines. "connection from" not the fault we are trying to block reactively. >Did you have any luck parsing the mailing list's archive? no, neither in my personal archives, nor through google. thanks Len
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200808250137406.SM01744>