Re: [cobalt-users] [RaQ3] Telnet Traffic

[jens@xxxxxxxxxxxxxxxxxxxx (Jens Kristian Søgaard)]

Florian Effenberger <florian.effenberger@xxxxxxxxxxxxx> writes:

> how can I log Telnet Traffic on a RaQ3? One of my users has Telnet
> access, and if he uses "wget" or so he can cause a lot of traffic
> which isn't in the logs... :-(

You must install the "UserIPAcct" software package, which provides per
user ip accounting for Linux. It is quite easy to install, but it
requires a kernel recompilation. If you do only have one RaQ (which
ofcourse is in production), it may not be possible to try this.

If you do only want to check, if an unreasonable amount of traffic is
being used (and you only have this one user), you may be able to get
off by installing an accounting rule in the kernel (using the ipfwadm
or ipchains utility). This will show all traffic on a specific ip (but
you cannot see, if it was user bob or alice that produced the
traffic).


-- 
Jens Kristian Søgaard, Mermaid Consulting I/S,
jens@xxxxxxxxxxxxxxxxxxxx,
http://www.mermaidconsulting.com/