LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-12-2003, 03:38 AM   #1
robmcw
LQ Newbie
 
Registered: Mar 2003
Location: aberdeen
Distribution: n/a
Posts: 18

Rep: Reputation: 0
Smile btmp only logs telnet failures


Hi, I am looking at my firewall machine and ways of
making it a bit more secure or accountable........
I have just created a /var/log/btmp file by touch
the owner/permissions are fine, as far as I understand
it should log failed attempted logins, it does this, but
only for telnet attempted logins not SSH ones.
Can anyone explain why not ? and an alternative ?
 
Old 03-12-2003, 02:58 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Uhm, Because ssh doesn't maintain login records? AFAIK it logs everything at the facility/level determined by what you specify at compile-time or in sshd_config. Which file it ends up in depends on syslog.conf.

If you want to be *really* sure, run sshd from strace, log in and try to see if any sshd process does a open/read/write on *any* of the login audit files /var/log/wtmp, /var/log/lastb or /var/run/utmp.
 
Old 03-17-2003, 05:22 AM   #3
robmcw
LQ Newbie
 
Registered: Mar 2003
Location: aberdeen
Distribution: n/a
Posts: 18

Original Poster
Rep: Reputation: 0
Many Thanks for your reply, but can you tell me.... if I want to
stop my telnet service why can I not type in #service telnet stop
it complains that there is no such service. Is the telnet service part of another service, hoa can I list my services in a format that
I can just use the #service stop/start process ?? I know the
services are listed in /etc/services, but I need to find out how those services are individually controlled. Any help would be
gratefully received...
 
Old 03-17-2003, 06:02 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Find file /etc/xinetd.d/telnet, change or add line "disabled = no" to yes. Restart xinetd.

If you want to secure your box but don't know how to start/stop services, maybe you'd like to start reading the LQ Security references at the top of this forum first.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Ubuntu logs on, then logs back off generallee5686 Ubuntu 0 10-20-2005 01:11 PM
Firefox logs user out? Where are error logs? case1984 Linux - General 0 10-09-2004 02:22 PM
Whare are logs for ftp, telnet and other netwrk connections ? stephnane AIX 5 05-17-2004 03:38 AM
Separate firewall logs and general logs dominant Linux - General 3 04-20-2004 01:26 AM
Can't see why telnet-stye software fails to connect from logs Izzard Linux - Networking 2 10-27-2003 03:01 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:05 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration