🚀 go-pugleaf

syscrc@pickle.gsu.edu (Randy Carpenter) writes:

>Is it possible with standard BSD telnet(1) and syslogd(1m) to create
>a log entry for outgoing telnet sessions.  I know that incoming login(1)
>sessions can be logged but I'm interested in the other way.  Something
>like a...

>  Nov  5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6".

>This would be helpful while tracing intrusions.

>I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of
>telling if another person has telneted out of the system is to dig around
>in the accounting records which is cumbersome and still doesn't tell me
>the outging host.  IRIX has a BSD-type telnet(1) and syslogd(1m).

>-- 
>===========================================================================
>Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
>Georgia State University           (404) 651-2648            No match.
>Wells Computer Center                                        %

Well, every 30 seconds, I have a perl script that wakes up and does an lsof
(the beta version of which happens to work on SGIs under 4.05), which gives
me all the open sockets on the machine, which it then runs into a filter
script that ignores (or doesn't ignore if I choose) local addresses and then
logs all external incoming and outgoing telnet connections to syslog. There
is a ps in the loop to get an idea of what is being done as well, and absolutly
no comments in the code which is pretty rough (I'm a perl novice). It is
not all that clean yet, and probably still has a bug or 10, but it would give
you a place to start. If you are interested send e-mail.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada