/var/log/secure shows me connections, i.e.
Jan 27 06:36:04 vanecek PAM_pwdb[20162]: (sshd) session opened for user admin
by (uid=0)
Jan 27 07:03:29 vanecek in.proftpd[20299]: warning: can't get client address:
Connection reset by peer
Jan 27 07:03:29 vanecek in.proftpd[20299]: connect from unknown
Jan 27 07:03:30 vanecek in.proftpd[20300]: connect from 211.42.97.65
What is not logged is the disconnection. That would be nice to know,
especially from something like the 211.xx domains. Anyone tell me where to
look or how to turn on disconnect logging in secure?
Thanks, Mike.
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
