Blog

List active FTP connections/users

To list the active FTP connections on your server use:

netstat -n | grep :21

root@web [~]# netstat -n | grep :21
tcp        0      0 162.255.200.197:80      17.58.101.200:21715     TIME_WAIT
tcp        0      0 162.255.200.197:37224   29.112.111.129:21       TIME_WAIT
tcp        0      0 162.255.200.197:21      69.117.199.248:3861     ESTABLISHED
tcp       30      0 162.255.200.197:56022   29.112.111.129:21       CLOSE_WAIT
tcp        0      0 162.255.200.197:46948   29.112.111.129:21       TIME_WAIT
tcp        0      0 162.255.200.197:80      175.100.10.241:21277    FIN_WAIT2
tcp        0      0 162.255.200.197:21      69.117.199.248:4498     ESTABLISHED
tcp        0      0 162.255.200.197:38998   29.112.111.129:21       ESTABLISHED
tcp        0      0 162.255.200.197:80      175.100.10.241:21276    TIME_WAIT

To list the server users, use:

ps aux| grep ftp

root@web [~]# ps aux| grep ftp
root       129  0.0  0.0  42688    80 ?        Ss    2019   0:11 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/local/cpanel/bin/pureauth
root       550  0.0  0.0 148816   276 ?        Ss    2019   0:13 pure-ftpd (SERVER)
bobcom   20107  0.0  0.0 148820   892 ?        S    05:41   0:00 pure-ftpd (IDLE)
root     20108  0.0  0.0 148820   604 ?        S    05:41   0:00 pure-ftpd (PRIV)
bobcom   20303  0.0  0.0 148820   892 ?        S    05:42   0:00 pure-ftpd (IDLE)
root     20304  0.0  0.0 148820   604 ?        S    05:42   0:00 pure-ftpd (PRIV)
root     24943  0.0  0.0   9096   664 pts/1    S+   05:54   0:00 grep --color=auto ftp
root@web [~]#

To summarize the above output:

ps aux | grep ftp | awk {'print $1'} | sort | uniq -c

root@web [~]# ps aux | grep ftp | awk {'print $1'} | sort | uniq -c
      2 bobcom
      6 root
root@web [~]#

Notice that the most information about the FTP activity you will get from the /var/log/messages. This is the log file for the Pure-FTPd on web hosting servers.

Tags:

Leave a Reply