Writing to logs when a user is banned for hammering

fridge66 · 12-03-2003, 10:42 PM

The hammer ban works great in ioFTPD, but I am wondering where it stores the login data? I'd really like to be able to see what IP's are not behaving themselves.

I've looked through the logs, but can only find sucessful login info. Am I missing a log somewhere?

Any help is appreciated...

-fridge66

darkone · 12-04-2003, 04:57 AM

Currently it doesn't log them..

wooolF[RM] · 12-04-2003, 07:46 AM

u can't unban either

odd · 12-04-2003, 11:57 PM

nice feature would be to be able to unbann and maybe read some logs ? Could it happend in some future io version?

neoxed · 12-05-2003, 12:11 AM

Would be useful to output ip/host/time banned of the users who hammered to the error.log

fridge66 · 12-05-2003, 01:35 PM

I don't care about un-ban. If the user manages to get themselves banned, I am in no hurry to un-ban.

BUt the error.log idea would be awesome. I'd like to see some kind of logs for malicous users in future versions, if at all possible.

-SP66

darkone · 12-05-2003, 02:48 PM

Quote:

Originally posted by fridge66
I don't care about un-ban. If the user manages to get themselves banned, I am in no hurry to un-ban.

BUt the error.log idea would be awesome. I'd like to see some kind of logs for malicous users in future versions, if at all possible.

-SP66

I'll consider this; however problem is that you can't show when ban expires; since if user connects while ban is active, ban will be renewed. (and hammering user, would cause huge resource [memory, disk, cpu] consumption [log writing])

fridge66 · 12-05-2003, 03:29 PM

Quote:

Originally posted by darkone
I'll consider this; however problem is that you can't show when ban expires; since if user connects while ban is active, ban will be renewed. (and hammering user, would cause huge resource [memory, disk, cpu] consumption [log writing])

I was thinking it could write something like this (I'm not a programmer so I hope I'm not off my horse):

[date/time] [IP] [HOSTNAME] [USERNAME USED]

Have this write to log until the user/ip is banned. So log would use fairly low resources. There would be in the case of a 3 connect ban, only 4 log entries written.

Even further, in ioftpd.ini, an option could be added =1 (basic logging like above) and =2 (verbose for those with mega puters). That way the people that utilize this function would be have to deal with getting the needed resources.

For me, ban duration/expiration mean little, I'd just like to have the core info.

Anyway, just a few ideas. If you could come up with something, i'd be appreciated.

Keep you the great work!

-fridge66

wooolF[RM] · 12-06-2003, 10:26 AM

also writing to log could probably get |Harm| to include it in ioBanana for displaying on IRC

:banana:

neoxed · 12-07-2003, 12:53 AM

fridge66: You wouldn't always be able to display the username of the person who is hammering. If they connect many times before a USER is issued from the client, the only info you would know is the IP and Ident of the person.

fridge66 · 12-07-2003, 01:38 PM

Quote:

Originally posted by NeoXed
fridge66: You wouldn't always be able to display the username of the person who is hammering. If they connect many times before a USER is issued from the client, the only info you would know is the IP and Ident of the person.

True. I was assuming USER1 hammers, it would only log the attempts till the time of ban. Obviously if the client is banned, they won't get the login prompt.

-fridge66