Some Problems

[Urs Meyer]

In article <9007031228.AA02562 at avelon.lerc.nasa.gov> fsfacca at AVELON.LERC.NASA.GOV (Tony Facca) writes:
>
>> Is there any way to log any anonymous login (I mean user, host and what he
>> downloads) to a file?
>
>Edit the file /usr/etc/inetd.conf and change the ftp line to look like this:
>
>ftp	stream	tcp	nowait	root	/usr/etc/ftpd       	ftpd -d -l
> 
>The -d switch will print debugging information in the /usr/adm/SYSLOG file and
>the -l switch logs ftp sessions.   Then restart the inetd daemon.
>
>[1;53H         Tony Facca         
>[2;53Hfsfacca at avelon.lerc.nasa.gov

BE WARNED, ftpd will log everything, PASSWORDS INCLUDED, even when a regular
(not anonymous) user logs in.  DO NOT USE THE DEBUG (-d) OPTION!

This is a serious bug.  Will it be fixed in 3.3?

Excerpt from /usr/adm/SYSLOG (SD3.2.1):

Jul  4 19:18:27 zeus ftpd[3000]: connection from claude
Jul  4 19:18:27 zeus ftpd[3000]: <--- 220
Jul  4 19:18:27 zeus ftpd[3000]: zeus FTP server (SGI 3.2.1 version 4.160 Oct  5 1989 14:43) ready.
Jul  4 19:18:34 zeus ftpd[3000]: FTPD: command: USER meyer^M
Jul  4 19:18:34 zeus ftpd[3000]: <--- 331
Jul  4 19:18:34 zeus ftpd[3000]: Password required for meyer.
Jul  4 19:18:40 zeus ftpd[3000]: FTPD: command: PASS XXXXXXXX^M
						     [cleartext password 
						      overwritten by the poster]
Jul  4 19:18:40 zeus ftpd[3000]: <--- 230
Jul  4 19:18:40 zeus ftpd[3000]: User meyer logged in.
Jul  4 19:18:44 zeus ftpd[3000]: FTPD: command: PORT 130,60,48,8,19,31^M
Jul  4 19:18:44 zeus ftpd[3000]: <--- 200
Jul  4 19:18:44 zeus ftpd[3000]: PORT command successful.
Jul  4 19:18:44 zeus ftpd[3000]: FTPD: command: LIST^M
Jul  4 19:18:44 zeus ftpd[3000]: <--- 150
Jul  4 19:18:44 zeus ftpd[3000]: Opening data connection for /bin/ls (ascii mode) (0 bytes).
Jul  4 19:18:44 zeus ftpd[3000]: <--- 226
Jul  4 19:18:44 zeus ftpd[3000]: Transfer complete.
Jul  4 19:19:06 zeus ftpd[3000]: FTPD: command: QUIT^M
Jul  4 19:19:06 zeus ftpd[3000]: <--- 221
Jul  4 19:19:06 zeus ftpd[3000]: Goodbye.

Urs Meyer ---------- meyer at ifi.unizh.ch, {uunet,...}!mcsun!cernvax!unizh!meyer
University of Zurich, Dept of Computer Science, Multimedia Lab, CH-8057 Zurich