Re: How to capture FTP session info?

[Blake Frantz <blake () mc net>]

Hello,

I'm assuming you also want the file contents.....

You would have to sniff on ports 20 and 21:

alert tcp any any <> my.ftp.server 20 (msg: "FTP Data";)
alert tcp any any <> my.ftp.server 21 (msg: "FTP Control";)

If this is a high volumn server your log files are gonna be huge.  With
this in mind I'd double check that /var/log/ is a on a seperate partition
that / to prevent your root filesystem from running out of space.

If you simply want the user and filename of the sent/recieved files
your ftp daemon probably has that capability built in.  If you running on
a linux box, edit your /etc/inetd.conf to read as follows:

Change This:
ftp  stream  tcp  nowait  root    /usr/sbin/tcpd  in.ftpd 

To This:
ftp  stream  tcp  nowait  root    /usr/sbin/tcpd  in.ftpd -l -L -i -o 

"-l" logs each FTP session to syslog.
"-L" will cause the server to log all USER commands
"-i" logs all recieved files to /var/log/xferlog
"-o" logs all sent files to /var/log/xferlog

This won't log the password.

If you want snort to catch the username, password, and filesnames you can
do the following:

alert tcp any any <> 209.172.184.62 21 (msg: "FTP User Name"; flags: PA; content:"USER ";nocase;)
alert tcp any any <> 209.172.184.62 21 (msg: "FTP User Name"; flags: PA; content:"PASS ";nocase;)

alert tcp any any <> 209.172.184.62 21 (msg: "FTP User Name"; flags: PA; content:"STORE ";nocase;)
alert tcp any any <> 209.172.184.62 21 (msg: "FTP User Name"; flags: PA; content:"RETR ";nocase;)


Hope this helps.

-Blake

================================================================= 
The Government, like diapers, should be replaced regularly, and
often for the same reasons. 

On Tue, 3 Jul 2001, Mohamed LRHAZI wrote:

> Hello all,
>
> Can somebody please tell me how to write a filter to capture :
> FTP sessions, the username, the password and the files transfered in both directions?
>
> I guess it is possible, isnt it ?
>
> Thank you very much.
>
> Mohamed~
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users