Log client IP?

GlobalSCAPE User Forum

Forums Register Login My Profile Inbox Address Book My Subscription My Forums

Member List Search Calendars FAQ Ticket List Log Out

Log client IP?

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Secure FTP Server] >> Secure FTP Server General Discussion >> Log client IP?

Page: [1]

Message

<< Older Topic Newer Topic >>

Log client IP? - 10/29/2009 9:44:17 AM

Robert.Ball

Posts: 1
Joined: 10/29/2009
Status: offline

v. 3.3.10

Is there some way to log incoming SSH sessions and grab the origin client IP address and username?

We are migrating to a new IP and we have hundreds of customers hitting our server by IP not name. (it's a bank security issue that requires the IP and not a host name)

I need to know which users are hitting the old IP address.

The server is behind a firewall that responds to the request and allows traffic through to a private address on the actual server. Thus the destination IP seen in the server is always the same private IP address.

I can capture packets on the firewall and see what the true destination ip is but I can't decrypt the SSH to see the username. I can also catch the origin client IP.

If I can capture the username and the origin IP for that username from the server I can easily cross match and get the list I need.

Thanks,

_____________________________

/RB

Post #: 1

RE: Log client IP? - 11/2/2009 9:54:35 AM

cybernut

Posts: 83
Joined: 2/19/2008
Status: offline

Mr. Ball,

I have seen this issue with Microsoft ISA servers as well. It picks up all the traffic and the IP is being recorded as that IP of the proxy, not of the client. I am not aware of how to work around this other than allowing the traffic directly to the server as I have done in the past. A load balancer will also cause this at times depending on the setup.

The User ID should show up in the log if you have it set for Advanced, but you cannot record the commands being sent after they establish the connection.

Cheers!

(in reply to Robert.Ball)

Post #: 2