how users were added to /etc/ftpusers ? - Aix

This is a discussion on how users were added to /etc/ftpusers ? - Aix ; Hi, We are running AIX 5.2 ML8. Few days ago ftp on port 21 was denied. I have noticed that logins were added to /etc/ftpusers. I cannot imagine that someone have changed these files simultaneously on many machines. Any one ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: how users were added to /etc/ftpusers ?

  1. how users were added to /etc/ftpusers ?

    Hi,

    We are running AIX 5.2 ML8. Few days ago ftp on port 21 was denied. I
    have noticed that logins were added to /etc/ftpusers.

    I cannot imagine that someone have changed these files simultaneously
    on many machines.

    Any one have an idea how /etc/ftpusers could be changed ?

    In case the only way to change this file is manually, how to know who
    have changed it ?

  2. Re: how users were added to /etc/ftpusers ?

    On Nov 30, 2:27 pm, News wrote:
    > Hi,
    >
    > We are running AIX 5.2 ML8. Few days ago ftp on port 21 was denied. I
    > have noticed that logins were added to /etc/ftpusers.
    >
    > I cannot imagine that someone have changed these files simultaneously
    > on many machines.
    >
    > Any one have an idea how /etc/ftpusers could be changed ?
    >
    > In case the only way to change this file is manually, how to know who
    > have changed it ?


    Get the time stamp of the file
    $ ls -l /etc/ftpusers

    Check if software has been added or updates has been applied to the
    system during this time
    $ lslpp -hc

    Check who did log into the machine
    $ last

    In case you have
    - sudo and syslog configured. Check sudo log as well
    - check audit log if audit has been enabled


    hth
    Hajo



  3. Re: how users were added to /etc/ftpusers ?

    On 30 nov, 16:06, Hajo Ehlers wrote:
    > On Nov 30, 2:27 pm, News wrote:
    >
    > > Hi,

    >
    > > We are running AIX 5.2 ML8. Few days ago ftp on port 21 was denied. I
    > > have noticed that logins were added to /etc/ftpusers.

    >
    > > I cannot imagine that someone have changed these files simultaneously
    > > on many machines.

    >
    > > Any one have an idea how /etc/ftpusers could be changed ?

    >
    > > In case the only way to change this file is manually, how to know who
    > > have changed it ?

    >
    > Get the time stamp of the file
    > $ ls -l /etc/ftpusers
    >
    > Check if software has been added or updates has been applied to the
    > system during this time
    > $ lslpp -hc
    >
    > Check who did log into the machine
    > $ last
    >
    > In case you have
    > - sudo and syslog configured. Check sudo log as well
    > - check audit log if audit has been enabled
    >
    > hth
    > Hajo


    Thanks !

    the command "last" was usefull

    the modification was done by a maintenance program

  4. Re: how users were added to /etc/ftpusers ?

    News wrote:

    > the modification was done by a maintenance program


    How sweet! A program that bans human beings...
    we are heading towards the world of 'Tron', no doubt.

+ Reply to Thread