Re: [Proftpd-user] mod_sftp - logging remote IP address on authentication?

>>>>> "TJ" == TJ Saunders <[email protected]> writes:

>> I've been asked to monitor SFTP logins on a host using proftpd v1.3.7e 
>> running on Ubuntu 22.04.3 LTS.  I've noticed that when a user is
>> authenticated, the log message looks like this:
>> 
>> 2024-01-01 21:05:56,180 mod_sftp/1.0.1[206509]: user 'blah' 
>> authenticated via 'password' method
>> 
>> but you don't show the remove IP address associated with that login.
>> 
>> I haven't tried this yet, but would modifying the pr_log_writefile()
>> to look like this work?
>> 
>> (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
>> "user '%s' authenticated via '%s' method from IP '%s'", user,
>> method, session.c->remote_addr);
>> 
>> So it's trivial to figure out where the use logged in from?

> Close.  It'd be:

>   (void) pr_log_writefile(sftpd_logfd, MOD_SFTP_VERSION,
>     "user '%s' authenticated via '%s' method from IP '%s'", user,
>     method, pr_netaddr_get_ipstr(session.c->remote_addr));

> since session.c->remote_addr points to a non-printable C struct.

Duh... I'm sure I would have found that once I started actually
compiling the code.  I do think it's a good change to make down the
line, since the core login info should be more easily seen in the
logs.  

> Another way to achieve this, if you want to avoid patching the
> source code directly, might be to configure an ExtendedLog that
> includes this information, using something like this:

>   # Use JSON here, assuming parseability of the generated ExtendedLog would be useful
>   LogFormat login '{user="%U",ip="%a",proto="%{protocol}"}'
>   ExtendedLog AUTH login

> unless you need the specific SSH authentication method as well; I'm
> not sure that's exposed (yet) for such custom LogFormat/ExtendedLog
> configurations.

Thanks, this is a good suggestion.  I don't want JSON format, just
plain text on a per-line basis if fine, but I think I can figure this
out from the docs.


Also, you might want to thing about putting a CNAME into DNS to point
proftpd.org to www.proftpd.org so that web connections from lazy sods
like me actually go through.  :-)


Thanks again for all your work on this software, it's really quite
amazing.

John


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html