Re: Notification of incoming telnet sessions..

[Darxus <darxus@Op.Net>]

On 28 Oct 1998, Rene Hojbjerg Larsen wrote:

> Michael Beattie wrote:
> > On Tue, 27 Oct 1998, Petter Adsen wrote:
> >> Michael Beattie writes:
> >> | I want to be able to have some form of notification when a telnet
> >> | connection is made to my linux box, most likely in the form of playing an
> >> [snip]
> >> 
> >> You can probably do this with tcpwrappers. See the manpages for
> >> hosts_access(5) and tcpd(8).
> > 
> > Hmmm.. thanks... I'll look into that one too.
> 
> Actually, it should be pretty easy.  You can just use the "spawn" option
> on the in.telnetd line in /etc/hosts.allow (see hosts_access(5) and
> hosts_options(5)).  Something like this will work:
> 
> in.telnetd: ALL: spawn /usr/bin/play /your/favourite/aufile &: ALLOW

I was going to give you another way, but I just realized that what I do
doesn't achieve this under Debian as it under Redhat 4.2 (which I recently
switched from).  In /etc/syslog.conf, I tell syslog to send authpriv.* and
auth.* to root and darxus, if they're logged in.  But apparently telnet
logins don't go to syslog via auth or authpriv in Debian, they go through
daemon, which also includes a lot of other crap which you probably don't
want continuously scrolling down your terminal.  But you may still be
interested in my /etc/syslog.conf file, as it sends *everything* to
/dev/tty12, so if you hit alt-f12, you'll see *everything* as it's sent
through syslog... rather useful.  If you just want to send everything to
/dev/tty12, you just need to add:


# send everything to /dev/tty12
*.*                             /dev/tty12


I also rearrange the logs... I put everything from syslog in
/var/log/syslog/<category> -- so if you use this, you'll need to create a
directory called /var/log/syslog for everything to go it.  Anyway, here's
my /etc/syslog.conf file:


# send everything to /dev/tty12 -- hit alt-f12 to view
*.*                         /dev/tty12

# send the most interesting stuff to users root & 
# darxus if they're logged in
authpriv.*                      root,darxus,/dev/tty9
auth.*                          root,darxus,/dev/tty9
kern.*                          root,darxus,/dev/tty9

# log everything to files in /var/log/syslog/<category>
# note: you must have a directory called /var/log/syslog
auth.*                          /var/log/syslog/auth
authpriv.*                      /var/log/syslog/authpriv
cron.*                          /var/log/syslog/cron
daemon.*                        /var/log/syslog/daemon
kern.*                          /var/log/syslog/kern
lpr.*                           /var/log/syslog/lpr
mail.*                          /var/log/syslog/mail
news.*                          /var/log/syslog/news
syslog.*                        /var/log/syslog/syslog
user.*                          /var/log/syslog/user
uucp.*                          /var/log/syslog/uucp
local0.*                        /var/log/syslog/local0
local1.*                        /var/log/syslog/local1
local2.*                        /var/log/syslog/local2
local3.*                        /var/log/syslog/local3
local4.*                        /var/log/syslog/local4
local5.*                        /var/log/syslog/local5
local6.*                        /var/log/syslog/local6
local7.*                        /var/log/syslog/local7