1

Ok, let's say I am responsible for old application that I don't really know the details of, I am trying to secure my server, and someone suggested to forbid the 21 port that used for FTP.

But I am not sure which programs are running and use FTP on a day to day basis.

Say I don't have the solution to install the tools I want on the server or on the Network. What are my solutions?

  • Should I cut the 21 port and see what transfers are blocked by the firewall?
  • Is there a place on the AIX server where I should go and look to see the list of accessed and accessing servers via this port? If I have the IP of the server(s) and the file names, I will be able to track the program doing it. So is there a log file for FTP?

Edit:

a) inetd is active and ftp is in it (thanks @JeffSchaller)

b) I am trying to know incoming and outgoing traffic on this port - with the commands that were performed (if possible). In other words, my goal is to know

  • What commands have been performed on the local FTP server
  • What commands have been performed by the local FTP client to other servers

Any suggestion welcome.

  • 5
    If you don't know what systems are using which services on your server you have a very big problem indeed. – roaima May 17 '18 at 14:06
  • 1
    Which FTP Server program are you using? – roaima May 17 '18 at 14:07
  • 1
    Is it running from inetd or standalone? – Jeff Schaller May 17 '18 at 14:08
  • 1
    Let me rephrase the truth that @roaima wrote above: if you are an AIX admin and don't know who/what uses your server, you are in a big, big trouble. – ajeh May 17 '18 at 14:37
  • 1
    Ok guys, let's say the admin is on vacation, and I want to prepare something to have relevant discussion with him when he comes back. – J. Chomel May 17 '18 at 14:41
6
+50

What commands have been performed on the local FTP server?

To enable FTP logging on an AIX system, you need to reconfigure FTP (being called by inetd in your case) to send debug logs to syslog and to configure syslog to save those logs to a file.

  1. Edit /etc/inetd.conf and add -d to the end of the ftpd line:

    ftp     stream  tcp6    nowait  root    /usr/sbin/ftpd  ftpd -d
    
  2. Refresh inetd: refresh -s inetd

  3. Edit /etc/syslog.conf and add a line for daemon.debug to save the logs somewhere:

    daemon.debug /var/log/ftp.log
    
  4. Create a file for syslog to write to: touch /var/log/ftp.log

  5. Refresh syslogd: refresh -s syslogd

Syslog will send any daemon's logs to this file, so you'll want to filter it down with grep, perhaps: grep 'daemon:debug ftpd' /var/log/ftp.log.

Commands that were sent via FTP will be logged with the string command:; here's a sample:

May 18 10:13:35 ftpserver daemon:debug ftpd[3932700]: command: USER username-here^M
May 18 10:13:35 ftpserver daemon:debug ftpd[3932700]: <--- 331
May 18 10:13:35 ftpserver daemon:debug ftpd[3932700]: Password required for username-here.
May 18 10:13:42 ftpserver daemon:debug ftpd[3932700]: command: PASS
May 18 10:13:42 ftpserver daemon:debug ftpd[3932700]: <--- 230-
May 18 10:13:42 ftpserver daemon:debug ftpd[3932700]: Last login: Fri May 18 10:13:02 EDT 2018 on ftp from ftpclient.example.com
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: <--- 230
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: User username-here logged in.
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: command: PORT 10,1,1,1,229,54^M
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: <--- 200
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: PORT command successful.
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: command: LIST^M
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: <--- 150
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: Opening data connection for /bin/ls.
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: <--- 226
May 18 10:13:43 ftpserver daemon:debug ftpd[3932700]: Transfer complete.

Yes, those Control-M's appear as such in the logs!


What commands have been performed by the local FTP client to other servers?

Since applications could perform their own FTP actions, it'd be difficult to wrap every possible client program (such as /usr/bin/ftp) to catch this. The best bet is to configure the remote FTP server to log the commands, just as we did above. Second-best would be to configure the AIX firewall to allow-and-log traffic destined for port 21.

Ensure you have the ipsec fileset installed:

lslpp -L bos.net.ipsec.rte; echo $?

It should show a fileset listed with a return code of 0, and not:

lslpp: 0504-132  Fileset bos.net.ipsec.rte not installed.

Ensure the ipsec devices are enabled:

lsdev -l ipsec_v4

You should get one line back saying "Available", not "Defined" or no lines back at all.

If there was no output or the device was "Defined":

  1. run smitty ipsec4
  2. choose Start/Stop IP Security,
  3. choose Start IP Security,
  4. leave the defaults at Now and After Reboot and Deny All Non_Secure = no
  5. hit Enter.

The ipsec device_v4 should now show as "Available".

Create a logging file with: touch /var/log/ipsec.log.

Update syslog:

echo "local4.debug /var/log/ipsec.log rotate size 100k files 4" >> /etc/syslog.conf
refresh -s syslogd

Add a rule to allow and log traffic destined for port 21:

# -v 4 == IPv4
# -n 2 == add this after the first rule
# -a P == permit
# -O eq == destination port *equals* 21
# -P 21 == destination port 21
# -w O == outbound connections; change this to “B” to log in both directions
# -c tcp == TCP protocol
# -s, -m, -d, -M = source/dest IP & mask (any)
# -l Y = Log it
# -r L = applies only to packets destined or originated from the local host
genfilt -v 4 -n 2 -a P -O eq -P 21 -w O -c tcp -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0  -l Y -r L -D “allow and log port 21 traffic”

Start logging:

mkfilt -g start

Activate the ruleset:

mkfilt -u

Wait for outbound FTP connections to occur, then:

grep ipsec_logd /var/log/ipsec.log | grep DP:21

You'll see source and destination IPs for outbound FTP connections along with the timestamps, such as:

May 18 11:29:40 localhost local4:info ipsec_logd: #:0 R:p  O:10.1.1.1 S:10.1.1.1 D:10.2.2.2 P:tcp SP:55091 DP:21 R:l I:en0 F:n T:0 L:0

It doesn't log the content (commands) of the FTP session, but you'll have timestamps and destinations. Note that every packet of each FTP connection is logged!


References:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.