From owner-freebsd-questions  Tue Oct 20 13:56:24 1998
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id NAA02150
          for freebsd-questions-outgoing; Tue, 20 Oct 1998 13:56:24 -0700 (PDT)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from emu.sourcee.com (emu.sourcee.com [199.201.159.173])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA02137
          for <freebsd-questions@freebsd.org>; Tue, 20 Oct 1998 13:56:19 -0700 (PDT)
          (envelope-from nrice@emu.sourcee.com)
Received: (from nrice@localhost)
	by emu.sourcee.com (8.9.1/8.9.1) id QAA22115;
	Tue, 20 Oct 1998 16:55:46 -0400 (EDT)
Message-ID: <19981020165545.C21548@emu.sourcee.com>
Date: Tue, 20 Oct 1998 16:55:45 -0400
From: "Norman C. Rice" <nrice@emu.sourcee.com>
To: Frank Griffith <frankg@idfw.com>, freebsd-questions@FreeBSD.ORG
Subject: Re: Who's in FTP
References: <000701bdfc58$b0b02f60$dcf6a2a5@fgriffth.ctxmort.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.91.1i
In-Reply-To: <000701bdfc58$b0b02f60$dcf6a2a5@fgriffth.ctxmort.com>; from Frank Griffith on Tue, Oct 20, 1998 at 01:37:27PM -0500
X-Mutt-References: <000701bdfc58$b0b02f60$dcf6a2a5@fgriffth.ctxmort.com>
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Tue, Oct 20, 1998 at 01:37:27PM -0500, Frank Griffith wrote:
> I have FreeBSD 2.2.7 running on a Pentium computer. 
> I use ppp tp connect to my ISP. From time to time, 
> other associates FTP into this server via the net and 
> transfer files.  
> 
> My question is, how can I see when someone logs into 
> FTP or Telnet? 

Try the `w' command.

> Also, how can I see a log of who has 
> accessed the computer via FTP and telnet?
> 

It depends on how /etc/syslog.conf is set up to log
events. You can add entries like

!ftpd
*.*				/var/log/ftp.log
*.*				frankg
!telnetd
*.*				/var/log/telnet.log
*.*				frankg

to the bottom of /etc/syslog.conf and send a -HUP to 
syslogd. Then create the empty log files.

  touch /var/log/telnet.log
  touch /var/log/ftp.log

Future ftp and telnet server events should be logged to 
the files indicated. User `frankg' will also be sent the
log message.

Note that the white space between the `*.*' and log file 
or user name must be created with TABs (no spaces!).

You can test this with the logger(1) command.

  logger -t ftpd "Someone's using ftp"
  logger -t telnetd "Someone's using telnet"

You can also kill and restart syslogd in the debug
mode (syslogd -d) if you are having problems (run
it in a separate window).

You may want to start ftpd with `-ll' (/etc/inetd.conf) to 
increase the amount of logging (man ftpd).
-- 
Regards,
Norman C. Rice, Jr.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message