[NTLUG:Discuss] ftp logs: username

[MadHat]

KungFusion wrote:
> 
> hi ntlugers!
> 
> Where is the username logged for ftp access? For example if I have a user
> ftping into a box with the username: desire
> where can I find that username that is sent to make sure this user is
> sending desire instead of Desire?
> 
> I looked in /log/xferlog and /log/secure  and didn't see anything except
> IP's and type of connection

It is going to depend on what FTPd you are running and how it is
configured.
It is often located i the default messages log file (commonly
/var/log/messages)
An entry from mine looks like

Mar 21 12:47:10 madhat ftpd[30771]: FTP LOGIN FROM lheath @ localhost
[127.0.0.1], lheath

This is supposed to be all one line, but I am sure it will get chopped.

it is the Date, machine, daemon[PID], what, ident @ machine [IP],
loginname
the ident won't show up unless the client (remote machine) has the
service it turned on.

-- 
%_=split';','2e;hac;40;not;64;ju;66; Perl ;68;st a;6f;ker;75;her';
print map $_{unpack "H2",$_}, split //,
'madhat at unspecific.com'
# aka Lee Heath, but don't tell anyone.