Keven commented "(Wow - still have back to 2013)"
I know you Keven. I am not surprised in the least.
-Craig
On Wednesday, January 17, 2024 at 03:19:18 PM PST, Keven Miller (3kG) <[log in to unmask]> wrote:
I wanted to say, as Donna and Robert, with system wide logon UDC, you can track logins.
I have a group LOG.SYS, with a file TERMLOG that gets appended with logons.
With appropriate logic and ENV vars like these:
HPJOBTYPE = "S"
HPREMIPADDR
HPSTDIN_NETWORK_ADDR
HPSTDIN_NETWORK_NODE
HPJOBNAME, HPUSER, HPACCOUNT
HPYYYYMMDD, HPHHMMSSMMM
HPLDEVIN
Note that when Telnet or other connections, HPREMIPADDR,
HPSTDIN_NETWORK_ADDR, HPSTDIN_NETWORK_NODE
may not be bound:
IF NOT BOUND ( HPREMIPADDR ) THEN
IF BOUND ( HPSTDIN_NETWORK_ADDR ) THEN
SETVAR HPREMIPADDR HPSTDIN_NETWORK_ADDR
ELSE
SETVAR HPREMIPADDR ""
ENDIF
ENDIF
IF NOT BOUND ( HPSTDIN_NETWORK_NODE ) THEN
SETVAR HPSTDIN_NETWORK_NODE ""
ENDIF
I log the following:
201305271142 KEV,MANAGER .SYS 10.0.1.66 RANGER1..ORG
201305281532 JAMES, MGR.JAMESD 71.9.129.37 Papa-Laptop
201305282112 TRUMAN, MGR.AD2KDEV 76.14.27.52 TSMITH-TOSHIBA
201305282237 PETER, MGR.KC1 76.27.74.203 IBSComputer-PC
201306120936 KEV, MGR.KEVENM 10.0.1.66 RANGER1..ORG
201306131504 JAMES, MGR.ADI 71.9.129.37 Papa-Laptop
201306171949 KEV, MGR.KEVENM 10.0.1.66 RANGER1..ORG
201306201150 KEV, MGR.KEVENM 10.0.1.107 Keven-HPPC
201308121001 KEV, MANAGER.SYS Console
201308211122 KEV, MGR.IEM 127.0.0.1 FOX.REELTAPETRA Loop
201309111843 MANAGER.SYS Console
201311271833 OPERATOR.SYS Console
201311282050 KEV, MANAGER.SYS 99.113.197.81
201311301513 KEV, MANAGER.SYS 127.0.0.1 FOX.REELTAPETRA Loop
201312290723 KEV, MGR.KEVENM 107.218.61.245 RANGER1..ORG
201404151208 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
201406200637 KEV, MGR.KEVENM Console
201410092152 KEV, MGR.KEVENM 10.0.1.66 KEVEN-HPPC..ORG
201508011922 KEV, MANAGER.SYS Console
201509120656 KEV, MANAGER.SYS 127.0.0.1 FOX.REELTAPETRA Loop
201510210900 KEVCON, MANAGER.SYS Console
201611200510 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
201801291708 K, MGR.ECHOTECH 10.0.1.51 DEMO.CHARON.COM
201801291709 K, MGR.ECHOTECH 10.0.1.51 DEMO.CHARON.COM
201807310918 RICKC, MGR.UNIX 47.156.198.89
201902020242 KEV, MGR.KEVENM 66.191.21.53 RANGER1..ORG
201902082100 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
201902260635 KEV, MGR.CSLXL 10.0.1.100 RANGER1..ORG
201903011050 KEV, MGR.FREEWARE 10.0.1.100 RANGER1..ORG
202006161241 K, MGR.KEVENM 10.0.1.100 ranger1
202010080706 USER.FTPGUEST 10.0.1.100 RANGER1..ORG
202010080727 MGR.FTPGUEST 10.0.1.100 RANGER1..ORG
202101211632 K, MGR.KEVENM 47.25.207.167
202101241952 KEV, MGR.KEVENM 96.61.150.51 RANGER1..ORG
202101242002 KEV, MGR.KEVENM 96.61.150.51 RANGER1..ORG
202109231159 TEL, MGR.KEVENM 206.123.212.146
202110050705 KEV2, MGR.KEVENM 10.0.1.100 RANGER1..ORG
202110070412 KEV, MANAGER.SYS Console
202112130628 OPERATOR.SYS Console
202205311736 KEV, MANAGER.SYS Console
202210221341 CRAIG, MANAGER.SYS 76.144.36.211 ECHOXPS..ORG
202303171001 TEL, MGR.KEVENM 10.0.1.100
202303171007 TEL, MGR.KEVENM 10.0.1.100
202303210959 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
202303211654 MGR.KEVENM 127.0.0.1 FOX.REELTAPETRA Loop
202307251640 KEVTEL, MGR.KEVENM 70.34.7.79
202309071223 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
202312221136 KEV, MGR.KEVENM 67.2.189.87 RANGER1..ORG
202312221524 KEV, MGR.KEVENM 10.0.1.100 RANGER1..ORG
(Wow - still have back to 2013)
----- Original Message -----
From: "Stanfield, Randy (Carrollton, TX)" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Wed 17 Jan 2024 02:06 PM
Subject: Re: [HP3000-L] Telnet services Logging
Thanks Tracy. We’re currently using this in our Jinetd today and I can see the FTP logs. I was trying to capture Telnet too. I didn’t know if it would occur in the same Job and couldn’t find documentation for it.
Donna and Robert Mills have passed some logon CMD/UDC’s I can implement to track my telnet connections I think.
Thanks again everyone.
veritiv.com
RandyStanfield
Senior IT Architect Infrastructure
Carrollton•TX
(972)982-3621
© 2023 Fortune Media IP Limited. Used under license.
This email may contain confidential or privileged information. Unless you are the intended
recipient, delete this email immediately and contact the sender at the address above.
From: Tracy Johnson <[log in to unmask]>
Sent: Wednesday, January 17, 2024 2:48 PM
To: Stanfield, Randy (Carrollton, TX) <[log in to unmask]>; [log in to unmask]
Subject: Re: [HP3000-L] Telnet services Logging
In your jinetd. net job change the run command to read: !run inetd. net. sys;pri=cs;info="-l Attempted connections will appear in the $STDLIST of the job. You won't get disconnections however. And there is no correlation between an attempted connection
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
|
