Subject: newbie question telnet logging

From: "mike.stowe" <[email-masked]>
Date: Tue, 24 Apr 2001 17:04:22 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

fwtk community:

we installed fwtk on a solaris 2.7 box.
we could not get the syslogd in the tools directory to compile on the
first pass.  so we are running the 2.7 syslogd.

we got the telnet proxy to work.  we tested telnet access through the
bastion host successfully.

we are puzzled by the lack of logging of telnet activity.  the
connections
are logged.
we were hoping to get telnet activity logged given the assertion at the
tis.com
website that:
=====
The
                      proxy server supports access control based on
IP-address and/or host name, and
                      supports secondary access control permitting any
destination to be selectively
                      blocked. All connections and bytes transferred are
logged.
========

 do the 'bytes transferred' get logged somewhere different from tn-gw
connection messages?  there is no -log paramter documented nor does one
work
on a tn-gw: ........permit.......... statement.

do we have to use the syslogd that ships with the toolkit (and if so,
why?)  we searched the supplied documentation, the faq, the
mailing list archives and did a general web search.

do we need to adjust some syslog.conf parms?

did we misunderstand what would be logged and just need to sniff one of
the bastion connections?

============-=
our syslog file looks like:
*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

*.alert;kern.err;daemon.err                     operator
*.alert                                         root

*.emerg                                         *

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice                    ifdef(`LOGHOST', /var/log/authlog,
@loghost)

mail.debug                      ifdef(`LOGHOST', /var/log/syslog,
@loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
user.alert                                      `root, operator'
user.emerg                                      *
=============-=

mike

---

From: Ted Keller <[email-masked]>
Date: Tue, 24 Apr 2001 20:54:41 -0400 (EDT)

Mike,

Telnet does log who connected, destination host connected to, and total
bytes logged.

You configure this through your netperm table as such

tn-gw:	permit-hosts	172.16.1.* -dest xxx.xxx.xxx.xxx -dest !172.16.1.*

or something similar to that.

hope this helps

ted keller

---

From: Tony Gale <[email-masked]>
Date: Wed, 25 Apr 2001 10:24:27 +0100

> Telnet does log who connected, destination host connected to, and total

It logs the number of bytes transfered. I believe the question was, does
it log what was transfered, i.e. what the user typed, and the answer
is...... no.

-tony
-- 
E-Mail: Tony Gale <[email-masked]>
The views expressed above are entirely those of the writer
and do not represent the views, policy or understanding of
any other person or official body.

---

From: Rick Murphy <[email-masked]>
Date: Wed, 25 Apr 2001 05:56:44 -0400

At 05:04 PM 4/24/01 -0600, mike.stowe wrote:
>=====
>The proxy server supports access control based on
>IP-address and/or host name, and supports secondary access control 
>permitting any
>destination to be selectively blocked. All connections and bytes 
>transferred are
>logged.
>========

The exit message from tn-gw gives the *count* of bytes transferred.
If you want the actual telnet data for a session to be logged, you really 
don't want that to go to syslog - syslog is a performance hog. You'll have 
to modify the tn-gw source to save the session data to a log file of your 
own somewhere.

>work on a tn-gw: ........permit.......... statement.

There's no need to have a "-log" parameter since there's no operations to 
log; protocols like FTP and HTTP have operations (GET, POST, CWD, etc.) 
that can be individually logged, but telnet is just a simple conection.

>why?)

No. In fact, I don't use it.
         -Rick

---

From: "mike.stowe" <[email-masked]>
Date: Wed, 25 Apr 2001 10:52:33 -0600

ted,  rick, tony:
  i appreciate your help.
we'll sniff the telnet connection to get what we want for now.
thanks,
mike

---

From: "mike.stowe" <[email-masked]>
Date: Wed, 25 Apr 2001 10:52:33 -0600

ted,  rick, tony:
  i appreciate your help.