Re: [Proftpd-user] mod_sftp - logging remote IP address on authentication?

> I've been asked to monitor SFTP logins on a host using proftpd v1.3.7e 
> running on Ubuntu 22.04.3 LTS.  I've noticed that when a user is
> authenticated, the log message looks like this:
>
>   2024-01-01 21:05:56,180 mod_sftp/1.0.1[206509]: user 'blah' 
> authenticated via 'password' method
>
> but you don't show the remove IP address associated with that login.
>
> I haven't tried this yet, but would modifying the pr_log_writefile()
> to look like this work?
>
>   (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
>     "user '%s' authenticated via '%s' method from IP '%s'", user,
>     method, session.c->remote_addr);
>
> So it's trivial to figure out where the use logged in from?

Close.  It'd be:

  (void) pr_log_writefile(sftpd_logfd, MOD_SFTP_VERSION,
    "user '%s' authenticated via '%s' method from IP '%s'", user,
    method, pr_netaddr_get_ipstr(session.c->remote_addr));

since session.c->remote_addr points to a non-printable C struct.

Another way to achieve this, if you want to avoid patching the source code directly, might be to configure an ExtendedLog that includes this information, using something like this:

  # Use JSON here, assuming parseability of the generated ExtendedLog would be useful
  LogFormat login '{user="%U",ip="%a",proto="%{protocol}"}'
  ExtendedLog AUTH login

unless you need the specific SSH authentication method as well; I'm not sure that's exposed (yet) for such custom LogFormat/ExtendedLog configurations.

Cheers,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html