From owner-freebsd-questions@FreeBSD.ORG Sun Aug 24 23:45:36 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0A5A9106566C for ; Sun, 24 Aug 2008 23:45:36 +0000 (UTC) (envelope-from LConrad@Go2France.com) Received: from mgw1.MEIway.com (mgw1.meiway.com [81.255.84.75]) by mx1.freebsd.org (Postfix) with ESMTP id D5AC48FC17 for ; Sun, 24 Aug 2008 23:45:35 +0000 (UTC) (envelope-from LConrad@Go2France.com) Received: from VirusGate.MEIway.com (virusgate.meiway.com [81.255.84.76]) by mgw1.MEIway.com (Postfix Relay Hub) with ESMTP id E164C471C2F for ; Mon, 25 Aug 2008 01:45:34 +0200 (CEST) Received: from localhost (localhost.MEIWay.com [127.0.0.1]) by VirusGate.MEIway.com (Postfix) with SMTP id E2AB83869A7 for ; Mon, 25 Aug 2008 01:45:34 +0200 (CEST) (envelope-from LConrad@Go2France.com) X-AV-Checked: Mon Aug 25 01:45:34 2008 virusgate.meiway.com Received: from mail.Go2France.com (ms1.meiway.com [81.255.84.73]) by VirusGate.MEIway.com (Postfix) with ESMTP id C5EB9386920 for ; Mon, 25 Aug 2008 01:45:34 +0200 (CEST) (envelope-from LConrad@Go2France.com) Received: from TX2.Go2France.com [66.90.247.9] by mail.Go2France.com with ESMTP (SMTPD32-7.07) id A0C07B7F00E0; Mon, 25 Aug 2008 01:37:36 +0200 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Sun, 24 Aug 2008 18:44:51 -0500 To: freebsd-questions@freebsd.org From: Len Conrad In-Reply-To: <20080825004724.ca193745.freebsd@edvax.de> References: <200808242325843.SM01744@TX2.Go2France.com> <20080824234412.c4356260.freebsd@edvax.de> <200808250011937.SM01744@TX2.Go2France.com> <20080825004724.ca193745.freebsd@edvax.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Message-Id: <200808250137406.SM01744@TX2.Go2France.com> Subject: Re: ftpd and sshd logging of domain names X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Aug 2008 23:45:36 -0000 > > with -ll, ftpd still logs failures as auth.log as > > same in ftpd.log > > [The IPs] they are not logged. > >I did the three steps I mentioned and have failures with IPs >logged in /var/log/ftpd.log, for example: > > connection from 79.165.190.70 (79.165.190.70) > FTP LOGIN FAILED FROM 79.165.190.70 > FTP LOGIN FAILED FROM 79.165.190.70, Administrateur > repeated login failures from 79.165.190.70 ... because the IP has no PTR > connection from projectvibe.net (205.234.98.200) > FTP LOGIN FAILED FROM projectvibe.net > FTP LOGIN FAILED FROM projectvibe.net, Administrator IP has PTR, whose domain name is logged. >But you're right, in the second example, the host name is logged, >not the IP, but the IP is always logged in the "connection from" >lines. "connection from" not the fault we are trying to block reactively. >Did you have any luck parsing the mailing list's archive? no, neither in my personal archives, nor through google. thanks Len