Logging outgoing telnet(1) sessions.

Article View: comp.security.misc

Article #464

Back to comp.security.misc Previous Next

#464

From: Randy Carpenter
Date: Thu, 05 Nov 1992 22:30

19 lines
1285 bytes

Is it possible with standard BSD telnet(1) and syslogd(1m) to create
a log entry for outgoing telnet sessions.  I know that incoming login(1)
sessions can be logged but I'm interested in the other way.  Something
like a...

  Nov  5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6".

This would be helpful while tracing intrusions.

I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of
telling if another person has telneted out of the system is to dig around
in the accounting records which is cumbersome and still doesn't tell me
the outging host.  IRIX has a BSD-type telnet(1) and syslogd(1m).

-- 
===========================================================================
Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
Georgia State University           (404) 651-2648            No match.
Wells Computer Center                                        %

Technical Details

Message-ID: <syscrc.721002634@gsusgi1.gsu.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!destroyer!gatech!gsusgi1.gsu.edu!gsusgi1.gsu.edu!syscrc

Show Full Headers

Complete Article Headers

Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!destroyer!gatech!gsusgi1.gsu.edu!gsusgi1.gsu.edu!syscrc
From: syscrc@pickle.gsu.edu (Randy Carpenter)
Subject: Logging outgoing telnet(1) sessions.
Message-ID: <syscrc.721002634@gsusgi1.gsu.edu>
Organization: Georgia State University
Date: Thu, 5 Nov 1992 22:30:34 GMT
Lines: 19