>From 53a0ca704eef2b6bd7826b0c7eda1615113ef3b9 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Mon, 14 Jan 2013 05:26:01 -0500 Subject: [PATCH 1/2] DISA FSO: Language changes to RHEL6/input/services/ftp.xml Language changes to FTP section, patched by DISA FSO --- RHEL6/input/services/ftp.xml | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/services/ftp.xml b/RHEL6/input/services/ftp.xml index 11cf6df..ef86002 100644 --- a/RHEL6/input/services/ftp.xml +++ b/RHEL6/input/services/ftp.xml @@ -92,10 +92,12 @@ If vsftpd is started by xinetd the following command will indicate the xinetd.d
# grep vsftpd /etc/xinetd.d/*
# grep server_args vsftpd xinetd.d startup file
This will indicate the vsftpd config file used when starting through xinetd. -If the server_argsline is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used. +If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
# grep xferlog_enable vsftpd config file
The modifications above ensure that all commands sent to the ftp server are logged using the verbose vsftpd log +To trace malicious activity facilitated by the FTP service, it must be configured to ensure that all commands sent to +the ftp server are logged using the verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log. If verbose logging to vsftpd.log is done, sparse logging of downloads to /var/log/xferlog will not also occur. However, the information about what files were downloaded is included in the information logged to vsftpd.log -- 1.7.1