Thread View: comp.security.misc
2 messages
2 total messages
Started by Randy Carpenter
Thu, 05 Nov 1992 22:30
Logging outgoing telnet(1) sessions.
Author: Randy Carpenter
Date: Thu, 05 Nov 1992 22:30
Date: Thu, 05 Nov 1992 22:30
19 lines
1285 bytes
1285 bytes
Is it possible with standard BSD telnet(1) and syslogd(1m) to create a log entry for outgoing telnet sessions. I know that incoming login(1) sessions can be logged but I'm interested in the other way. Something like a... Nov 5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6". This would be helpful while tracing intrusions. I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of telling if another person has telneted out of the system is to dig around in the accounting records which is cumbersome and still doesn't tell me the outging host. IRIX has a BSD-type telnet(1) and syslogd(1m). -- =========================================================================== Randy Carpenter rcarpent@gsu.edu % Got a light? Georgia State University (404) 651-2648 No match. Wells Computer Center %
Re: Logging outgoing telnet(1) sessions.
Author: Peter Van Epp
Date: Fri, 06 Nov 1992 16:25
Date: Fri, 06 Nov 1992 16:25
34 lines
2207 bytes
2207 bytes
syscrc@pickle.gsu.edu (Randy Carpenter) writes: >Is it possible with standard BSD telnet(1) and syslogd(1m) to create >a log entry for outgoing telnet sessions. I know that incoming login(1) >sessions can be logged but I'm interested in the other way. Something >like a... > Nov 5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6". >This would be helpful while tracing intrusions. >I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of >telling if another person has telneted out of the system is to dig around >in the accounting records which is cumbersome and still doesn't tell me >the outging host. IRIX has a BSD-type telnet(1) and syslogd(1m). >-- >=========================================================================== >Randy Carpenter rcarpent@gsu.edu % Got a light? >Georgia State University (404) 651-2648 No match. >Wells Computer Center % Well, every 30 seconds, I have a perl script that wakes up and does an lsof (the beta version of which happens to work on SGIs under 4.05), which gives me all the open sockets on the machine, which it then runs into a filter script that ignores (or doesn't ignore if I choose) local addresses and then logs all external incoming and outgoing telnet connections to syslog. There is a ps in the loop to get an idea of what is being done as well, and absolutly no comments in the code which is pretty rough (I'm a perl novice). It is not all that clean yet, and probably still has a bug or 10, but it would give you a place to start. If you are interested send e-mail. Peter Van Epp / Operations and Technical Support Simon Fraser University, Burnaby, B.C. Canada
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads