Hi Daniel GridFTP protocol & its Globus implementation is used in US TeraGrid project like http://www.teragrid.org/, or Open Science Grid http://www.opensciencegrid.org/ , or in Europe in Genesi-Dr http://www.genesi-dr.eu/, EGEE http://www.eu-egee.org/, etc..
so it has a very large community this is a log fragment for a good transaction: [4609] Wed Jul 16 22:04:42 2008 :: New connection from: wnode0406:42067 [4609] Wed Jul 16 22:04:42 2008 :: DN /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=samoper/CN=582979/CN=YYY XXX successfully authorized. [4609] Wed Jul 16 22:04:42 2008 :: User sgmops001 successfully authorized. [4609] Wed Jul 16 22:04:42 2008 :: Starting to transfer "/home/sgmops001/.globus/.gass_cache/local/md5/c5/6819e9394fdd304c0e38c3d875e746/md5/44/634526ab4efd0c35ecf41465259d25/data". [4609] Wed Jul 16 22:04:42 2008 :: Finished transferring "/home/sgmops001/.globus/.gass_cache/local/md5/c5/6819e9394fdd304c0e38c3d875e746/md5/44/634526ab4efd0c35ecf41465259d25/data". [4609] Wed Jul 16 22:04:42 2008 :: Closed connection from wnode0406:42067 if I try a simple ftp connection vs the GridFTP server without use my X509 I got this fragment: [25327] Wed Jul 16 22:30:20 2008 :: Server started in inetd mode. [25327] Wed Jul 16 22:30:20 2008 :: New connection from: XX-YYY-ZZ-WWW.fastres.net:37364 [25327] Wed Jul 16 22:31:50 2008 :: Closed connection from XX-YYY-ZZ-WWW.fastres.net:37364 and stop, without any message about the authentication/authorization phase A lot of these attempts from a specific IP should be considered a DoS because on Grid the service always use X509 Proxy Certificate to start net connections is it easy to implement some OSSEC rules for this ? many thanks again, Fabio Daniel Cid wrote: > Hi Fabio, > > We currently do not support GridFTP (first time I hear about it), but > if you can provide > some log samples, we can work on some decoders/rules for it. > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > 2008/7/14 Fabio Martinelli <[EMAIL PROTECTED]>: > >> Dear OSSEC users >> >> is there some OSSEC plugins to understand GridFTP server logs ? >> http://www.globus.org/toolkit/docs/4.2/4.2.0/data/gridftp/ >> >> it's important configure the iptables fw in response to Internet DoS vs >> GridFTP >> >> many thanks, >> Fabio >> >> >> >>
begin:vcard fn:Fabio Martinelli n:Martinelli;Fabio org:INFN Tor Vergata adr:;;via della ricerca scientifica, 1;ROME;;;ITALY email;internet:[EMAIL PROTECTED] title:Grid Computing Group tel;work:+39 06 7259 4113 note;quoted-printable:Laurea V.O. in Informatica nel 2004, = =0D=0A= esperienze in = =0D=0A= ESA Frascati, = =0D=0A= ENEA Frascati, = =0D=0A= Accenture Roma, = =0D=0A= INFN Tor Vergata. x-mozilla-html:TRUE url:http://grid.roma2.infn.it/ version:2.1 end:vcard
