How/where to get failed FTP authentication logs?
I'm never sure if this is the right place to ask, but if not please let me know.
So I have to get a list of FTP failed authentication logs, more specifically get the IPs where they originated. Software independent that is, so I won't get them from a folder or so, they should come from Event Viewer.
But I haven't found any events that are meant specifically for this purpose and I don't know for sure they exist.
I have some code (most of it was copied from another question which I don't remember the name of), to retrieve event information in xml format, from where I then retrieve substrings with the IPs and names of users. Here are the functions:
public string QueryActiveLog()
{
string res = "";
string queryString = @"
<QueryList>
<Query Id='0' Path='Security'>
<Select Path='Security'>*[System[(EventID=4624)]] and *[EventData[Data[@Name='IpAddress']!='-']]</Select>
</Query>
</QueryList>";
EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
EventLogReader logReader = new EventLogReader(eventsQuery);
// Display event info
res = DisplayEventLogInformation(logReader);
return res;
}
public string DisplayEventLogInformation(EventLogReader logReader)
{
string res = "";
for (EventRecord eventInstance = logReader.ReadEvent(); null != eventInstance; eventInstance = logReader.ReadEvent())
{
EventLogRecord logRecord = (EventLogRecord)eventInstance;
res += logRecord.ToXml() + Environment.NewLine + Environment.NewLine;
}
return res;
}
/// <summary>
/// orig -> original string // Options for args: "ip" -> get IPs from string, "user" -> get user names from string
/// </summary>
/// <param name="orig"></param>
/// <param name="args"></param>
/// <returns></returns>
public List<string> getSubstrings(string orig, string args)
{
int index1 = 0, index2 = 0;
List<string> subres = new List<string>();
switch (args)
{
case "ip":
while (index2 < orig.LastIndexOf("<Data Name='IpAddress'>"))
{
index1 = orig.IndexOf("<Data Name='IpAddress'>", index2) + 23;
index2 = orig.IndexOf("</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
case "user":
while (index2 < orig.LastIndexOf("<Data Name='SubjectUserName'>"))
{
index1 = orig.IndexOf("<Data Name='SubjectUserName'>", index2) + 29;
index2 = orig.IndexOf("$</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
default:
subres.Add("Invalid option");
return subres;
}
}
Here the event it's getting its information from is 4624 (just as an example), my question is if there is an event specifically for instances of failed FTP authentication so I can use it in this format.
EDIT
As suggested by Martin Prikryl, to clarify, I'm on the server side and want to get notified for when a client tries to access my server and fails, independently of what software the client is using.
c# windows events iis ftp
|
show 3 more comments
I'm never sure if this is the right place to ask, but if not please let me know.
So I have to get a list of FTP failed authentication logs, more specifically get the IPs where they originated. Software independent that is, so I won't get them from a folder or so, they should come from Event Viewer.
But I haven't found any events that are meant specifically for this purpose and I don't know for sure they exist.
I have some code (most of it was copied from another question which I don't remember the name of), to retrieve event information in xml format, from where I then retrieve substrings with the IPs and names of users. Here are the functions:
public string QueryActiveLog()
{
string res = "";
string queryString = @"
<QueryList>
<Query Id='0' Path='Security'>
<Select Path='Security'>*[System[(EventID=4624)]] and *[EventData[Data[@Name='IpAddress']!='-']]</Select>
</Query>
</QueryList>";
EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
EventLogReader logReader = new EventLogReader(eventsQuery);
// Display event info
res = DisplayEventLogInformation(logReader);
return res;
}
public string DisplayEventLogInformation(EventLogReader logReader)
{
string res = "";
for (EventRecord eventInstance = logReader.ReadEvent(); null != eventInstance; eventInstance = logReader.ReadEvent())
{
EventLogRecord logRecord = (EventLogRecord)eventInstance;
res += logRecord.ToXml() + Environment.NewLine + Environment.NewLine;
}
return res;
}
/// <summary>
/// orig -> original string // Options for args: "ip" -> get IPs from string, "user" -> get user names from string
/// </summary>
/// <param name="orig"></param>
/// <param name="args"></param>
/// <returns></returns>
public List<string> getSubstrings(string orig, string args)
{
int index1 = 0, index2 = 0;
List<string> subres = new List<string>();
switch (args)
{
case "ip":
while (index2 < orig.LastIndexOf("<Data Name='IpAddress'>"))
{
index1 = orig.IndexOf("<Data Name='IpAddress'>", index2) + 23;
index2 = orig.IndexOf("</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
case "user":
while (index2 < orig.LastIndexOf("<Data Name='SubjectUserName'>"))
{
index1 = orig.IndexOf("<Data Name='SubjectUserName'>", index2) + 29;
index2 = orig.IndexOf("$</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
default:
subres.Add("Invalid option");
return subres;
}
}
Here the event it's getting its information from is 4624 (just as an example), my question is if there is an event specifically for instances of failed FTP authentication so I can use it in this format.
EDIT
As suggested by Martin Prikryl, to clarify, I'm on the server side and want to get notified for when a client tries to access my server and fails, independently of what software the client is using.
c# windows events iis ftp
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27
|
show 3 more comments
I'm never sure if this is the right place to ask, but if not please let me know.
So I have to get a list of FTP failed authentication logs, more specifically get the IPs where they originated. Software independent that is, so I won't get them from a folder or so, they should come from Event Viewer.
But I haven't found any events that are meant specifically for this purpose and I don't know for sure they exist.
I have some code (most of it was copied from another question which I don't remember the name of), to retrieve event information in xml format, from where I then retrieve substrings with the IPs and names of users. Here are the functions:
public string QueryActiveLog()
{
string res = "";
string queryString = @"
<QueryList>
<Query Id='0' Path='Security'>
<Select Path='Security'>*[System[(EventID=4624)]] and *[EventData[Data[@Name='IpAddress']!='-']]</Select>
</Query>
</QueryList>";
EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
EventLogReader logReader = new EventLogReader(eventsQuery);
// Display event info
res = DisplayEventLogInformation(logReader);
return res;
}
public string DisplayEventLogInformation(EventLogReader logReader)
{
string res = "";
for (EventRecord eventInstance = logReader.ReadEvent(); null != eventInstance; eventInstance = logReader.ReadEvent())
{
EventLogRecord logRecord = (EventLogRecord)eventInstance;
res += logRecord.ToXml() + Environment.NewLine + Environment.NewLine;
}
return res;
}
/// <summary>
/// orig -> original string // Options for args: "ip" -> get IPs from string, "user" -> get user names from string
/// </summary>
/// <param name="orig"></param>
/// <param name="args"></param>
/// <returns></returns>
public List<string> getSubstrings(string orig, string args)
{
int index1 = 0, index2 = 0;
List<string> subres = new List<string>();
switch (args)
{
case "ip":
while (index2 < orig.LastIndexOf("<Data Name='IpAddress'>"))
{
index1 = orig.IndexOf("<Data Name='IpAddress'>", index2) + 23;
index2 = orig.IndexOf("</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
case "user":
while (index2 < orig.LastIndexOf("<Data Name='SubjectUserName'>"))
{
index1 = orig.IndexOf("<Data Name='SubjectUserName'>", index2) + 29;
index2 = orig.IndexOf("$</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
default:
subres.Add("Invalid option");
return subres;
}
}
Here the event it's getting its information from is 4624 (just as an example), my question is if there is an event specifically for instances of failed FTP authentication so I can use it in this format.
EDIT
As suggested by Martin Prikryl, to clarify, I'm on the server side and want to get notified for when a client tries to access my server and fails, independently of what software the client is using.
c# windows events iis ftp
I'm never sure if this is the right place to ask, but if not please let me know.
So I have to get a list of FTP failed authentication logs, more specifically get the IPs where they originated. Software independent that is, so I won't get them from a folder or so, they should come from Event Viewer.
But I haven't found any events that are meant specifically for this purpose and I don't know for sure they exist.
I have some code (most of it was copied from another question which I don't remember the name of), to retrieve event information in xml format, from where I then retrieve substrings with the IPs and names of users. Here are the functions:
public string QueryActiveLog()
{
string res = "";
string queryString = @"
<QueryList>
<Query Id='0' Path='Security'>
<Select Path='Security'>*[System[(EventID=4624)]] and *[EventData[Data[@Name='IpAddress']!='-']]</Select>
</Query>
</QueryList>";
EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
EventLogReader logReader = new EventLogReader(eventsQuery);
// Display event info
res = DisplayEventLogInformation(logReader);
return res;
}
public string DisplayEventLogInformation(EventLogReader logReader)
{
string res = "";
for (EventRecord eventInstance = logReader.ReadEvent(); null != eventInstance; eventInstance = logReader.ReadEvent())
{
EventLogRecord logRecord = (EventLogRecord)eventInstance;
res += logRecord.ToXml() + Environment.NewLine + Environment.NewLine;
}
return res;
}
/// <summary>
/// orig -> original string // Options for args: "ip" -> get IPs from string, "user" -> get user names from string
/// </summary>
/// <param name="orig"></param>
/// <param name="args"></param>
/// <returns></returns>
public List<string> getSubstrings(string orig, string args)
{
int index1 = 0, index2 = 0;
List<string> subres = new List<string>();
switch (args)
{
case "ip":
while (index2 < orig.LastIndexOf("<Data Name='IpAddress'>"))
{
index1 = orig.IndexOf("<Data Name='IpAddress'>", index2) + 23;
index2 = orig.IndexOf("</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
case "user":
while (index2 < orig.LastIndexOf("<Data Name='SubjectUserName'>"))
{
index1 = orig.IndexOf("<Data Name='SubjectUserName'>", index2) + 29;
index2 = orig.IndexOf("$</Data>", index1);
subres.Add(orig.Substring(index1, index2 - index1));
}
return subres;
default:
subres.Add("Invalid option");
return subres;
}
}
Here the event it's getting its information from is 4624 (just as an example), my question is if there is an event specifically for instances of failed FTP authentication so I can use it in this format.
EDIT
As suggested by Martin Prikryl, to clarify, I'm on the server side and want to get notified for when a client tries to access my server and fails, independently of what software the client is using.
c# windows events iis ftp
c# windows events iis ftp
edited Nov 20 '18 at 12:50
S. M.
asked Nov 20 '18 at 11:52
S. M.S. M.
1538
1538
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27
|
show 3 more comments
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27
|
show 3 more comments
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53392421%2fhow-where-to-get-failed-ftp-authentication-logs%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53392421%2fhow-where-to-get-failed-ftp-authentication-logs%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What do you mean by "software independent"? Do you mean that it should work for any FTP server possibly installed on the machine?
– Martin Prikryl
Nov 20 '18 at 12:09
Yes, but if that's not possible then only for FTP sessions that don't use external software, like Filezilla or so. It should work for FTP done through available Windows tools, if that makes sense.
– S. M.
Nov 20 '18 at 12:11
That's what I meant, I gave an example of external software, I wasn't saying Filezilla isn't. Just bad interpretation or bad phrasing from my part there.
– S. M.
Nov 20 '18 at 12:13
When you configure manually an ftp server/client, and use, for example, a browser or the file explorer to access it.
– S. M.
Nov 20 '18 at 12:18
For example, you can use Filezilla (or any other software), which you have to download, then you use their interface to access a server. You can also do this without downloading any software, which is by using the windows file explorer or just any regular browser, put in the ip or address you want to reach, and if you have the needed authentication information, you'll get in and a successful login event, if not, you can't enter, and the server will get notified that someone tried to access it but failed. When you don't use any downloaded software, that's "internal software" to me.
– S. M.
Nov 20 '18 at 12:27