From owner-freebsd-questions Tue Jun 2 09:29:42 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id JAA24933 for freebsd-questions-outgoing; Tue, 2 Jun 1998 09:29:42 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from pau-amma.whistle.com (s205m64.whistle.com [207.76.205.64]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id JAA24885 for ; Tue, 2 Jun 1998 09:29:30 -0700 (PDT) (envelope-from dhw@whistle.com) Received: (from dhw@localhost) by pau-amma.whistle.com (8.8.7/8.8.7) id JAA02758; Tue, 2 Jun 1998 09:28:25 -0700 (PDT) (envelope-from dhw) Date: Tue, 2 Jun 1998 09:28:25 -0700 (PDT) From: David Wolfskill Message-Id: <199806021628.JAA02758@pau-amma.whistle.com> To: chrismar@peanut.readington.com, freebsd-questions@FreeBSD.ORG Subject: Re: Loggin Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG >Date: Mon, 1 Jun 1998 23:09:23 -0400 (EDT) >From: Chris Martino >Is it possible to log attempted logins? Not the message you get when you >get with login failures. >I want to perhaps log attemted incoming ips and such BEFRE they begin to >login. If you limit the scope to certain protocol/port combinations (such as TCP/23 for TELNET), either ipfw or tcp_wrappers can accomplish some logging. I expect you'll find tcp_wrappers somewhat more flexible. To a certain extent, either may also be used to limit source/destination pairs for the activity in question. They are not mutually exclusive. david -- David Wolfskill UNIX System Administrator dhw@whistle.com voice: (650) 577-7158 pager: (650) 371-4621 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message