log ftp files

relina · 04-19-2022, 12:28 PM

Hello good morning

I'm trying to make a script or something to keep track of what users upload to a vftp server

I don't know if you could help me

TB0ne · 04-19-2022, 01:00 PM

Quote:

Originally Posted by relina

Hello good morning
I'm trying to make a script or something to keep track of what users upload to a vftp server I don't know if you could help me

We absolutely can help you; if you'd like a script, then you need to post what YOU have written/done/tried on your own. Read the "Question Guidelines" link in my posting signature. We're happy to help if you're stuck, but we aren't going to write scripts for you.

Beyond that, there are many guides on how to enable verbose logging for a VSFTPD server. You don't say what version/distro of Linux you're using, or version of VSFTPD, but things like this:

Code:

xferlog_enable=YES
xferlog_std_format=NO
xferlog_file=/var/log/vsftpd.log
log_ftp_protocol=YES

..may be all you need. Look at the vsftpd configuration pages for explanations on those options and what they do on your version.

relina · 04-19-2022, 04:09 PM

Quote:

Originally Posted by TB0ne

We absolutely can help you; if you'd like a script, then you need to post what YOU have written/done/tried on your own. Read the "Question Guidelines" link in my posting signature. We're happy to help if you're stuck, but we aren't going to write scripts for you.

Beyond that, there are many guides on how to enable verbose logging for a VSFTPD server. You don't say what version/distro of Linux you're using, or version of VSFTPD, but things like this:

Code:

xferlog_enable=YES
xferlog_std_format=NO
xferlog_file=/var/log/vsftpd.log
log_ftp_protocol=YES

..may be all you need. Look at the vsftpd configuration pages for explanations on those options and what they do on your version.

thank you,

Of course, of course, I don't want them to write the script for me, but to guide me a bit because I don't know where to start, I have fairly good knowledge of bash but of no other language (ok bash is not a language as such)

I don't know whether to do a continuous tail to the atuh.log file and when X users connect, do an ls -l to that user's directory... but the truth is that it seems to me something very rudimentary... but I don't have a programmer mentality

oh and answering your questions my vsftpd is 3.0.3 and my distro is debian 10

relina · 04-19-2022, 04:28 PM

Also say that on my server they connect through ftp but that they are caged users because the connections, although they are through an ftp for the users, are actually ssh since they are configured in the /etc/ssh/sshd_conf file with something like this:
Match user USER
Chroot Directory /mnt/ftp/USER
AllowTcpForwarding no
ForceCommand internal-sftp
Password Authentication yes

TB0ne · 04-19-2022, 05:34 PM

Quote:

Originally Posted by relina

thank you,
Of course, of course, I don't want them to write the script for me, but to guide me a bit because I don't know where to start, I have fairly good knowledge of bash but of no other language (ok bash is not a language as such)

I don't know whether to do a continuous tail to the atuh.log file and when X users connect, do an ls -l to that user's directory... but the truth is that it seems to me something very rudimentary... but I don't have a programmer mentality oh and answering your questions my vsftpd is 3.0.3 and my distro is debian 10

...and...

Quote:

Originally Posted by relina

Also say that on my server they connect through ftp but that they are caged users because the connections, although they are through an ftp for the users, are actually ssh since they are configured in the /etc/ssh/sshd_conf file with something like this:

Code:

Match user USER
Chroot Directory /mnt/ftp/USER
AllowTcpForwarding no
ForceCommand internal-sftp
Password Authentication yes

SFTP is *NOT* using VSFTPD, so logging vsftp is different than logging sftp. Which one are you actually using?? You were given directives for configuring VSFTPD previously, which will exactly log what you're after.

If they're using SFTP, you need to look into using inotify on those home directories, which will do what you're after.