Re: [Proftpd-user] mod_sftp - logging remote IP address on authentication?

You're logging "MOD_SFTP_VERSION"

Would it be possible to log Kex & Encryption & Mac algos to the logs, too?

I have a server with "legacy" ciphers still enabled, and it's difficult to
identify which users are still on old technology stacks - and we can't just
turn them off and tell our users to deal with it - so I want to identify
our offenders and contact them directly.


On Wed, Jan 3, 2024 at 10:56 AM TJ Saunders <[email protected]> wrote:

>
> > I've been asked to monitor SFTP logins on a host using proftpd v1.3.7e
> > running on Ubuntu 22.04.3 LTS.  I've noticed that when a user is
> > authenticated, the log message looks like this:
> >
> >   2024-01-01 21:05:56,180 mod_sftp/1.0.1[206509]: user 'blah'
> > authenticated via 'password' method
> >
> > but you don't show the remove IP address associated with that login.
> >
> > I haven't tried this yet, but would modifying the pr_log_writefile()
> > to look like this work?
> >
> >   (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
> >     "user '%s' authenticated via '%s' method from IP '%s'", user,
> >     method, session.c->remote_addr);
> >
> > So it's trivial to figure out where the use logged in from?
>
> Close.  It'd be:
>
>   (void) pr_log_writefile(sftpd_logfd, MOD_SFTP_VERSION,
>     "user '%s' authenticated via '%s' method from IP '%s'", user,
>     method, pr_netaddr_get_ipstr(session.c->remote_addr));
>
> since session.c->remote_addr points to a non-printable C struct.
>
> Another way to achieve this, if you want to avoid patching the source code
> directly, might be to configure an ExtendedLog that includes this
> information, using something like this:
>
>   # Use JSON here, assuming parseability of the generated ExtendedLog
> would be useful
>   LogFormat login '{user="%U",ip="%a",proto="%{protocol}"}'
>   ExtendedLog AUTH login
>
> unless you need the specific SSH authentication method as well; I'm not
> sure that's exposed (yet) for such custom LogFormat/ExtendedLog
> configurations.
>
> Cheers,
> TJ
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html
>

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html