ftpcheck
Current version: 1.1, released 19 Feb 2006 (changelog)
If you find this script useful, you may make a small donation to help support further development. Thanks!
ftpcheck is a PHP script -- designed to be run by cron on a Linux system -- that examines an FTP log for file uploads (of designated file types) and sends an email notification when matches are found.
The FTP log is expected to be in WU-FTPD xferlog format, a common format used by many FTP servers. The script was developed using Pure-FTPd but should also work with ProFTPD and other FTP servers that use this logging format.
The FTP log is expected to be in WU-FTPD xferlog format, a common format used by many FTP servers. The script was developed using Pure-FTPd but should also work with ProFTPD and other FTP servers that use this logging format.
How It Works
ftpcheck is designed to run at periodic intervals via a cron job, in PHP CLI-mode. It obtains the filesize of the FTP log and records it in a temporary file. This information provides the starting point (in the FTP log) for the next run, to avoid re-processing the same log entries each time.
Using regular expressions, the script then looks for lines in the log file that match a list of file extensions supplied in the script configuration. If matches are found, the matching lines are sent via email to an address specified in the script configuration.
Using regular expressions, the script then looks for lines in the log file that match a list of file extensions supplied in the script configuration. If matches are found, the matching lines are sent via email to an address specified in the script configuration.
Setup & Configuration
Important Note for cPanel Users!
cPanel deletes the FTP log after a stats run, so you'll need to turn that behaviour off in Web Host Manager. In WHM go to:
and put a checkmark in the box by:
Then you will need to implement log rotation for the FTP log so that it does not grow endlessly. To do this, create a new text file called "ftpd" (the name is not important) in the directory
Of course you must create/edit this file as root. If you do not want rotated logs to be gzipped remove the "compress" line.
cPanel deletes the FTP log after a stats run, so you'll need to turn that behaviour off in Web Host Manager. In WHM go to:
Tweak Settings -> Stats and Logs section
and put a checkmark in the box by:
"Do not reset /usr/local/apache/domlogs/ftpxferlog after it has been seperated...."
Then you will need to implement log rotation for the FTP log so that it does not grow endlessly. To do this, create a new text file called "ftpd" (the name is not important) in the directory
/etc/logrotate.d with the following:
/usr/local/apache/domlogs/ftpxferlog {
missingok
compress
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/pure-ftpd.pid 2>/dev/null` 2> /dev/null || true
endscript
}
missingok
compress
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/pure-ftpd.pid 2>/dev/null` 2> /dev/null || true
endscript
}
Of course you must create/edit this file as root. If you do not want rotated logs to be gzipped remove the "compress" line.
Setup:
- Get the script (see the Download section below) and save it as ftpcheck.php;
- Edit the configuration variables at the top of the script. These are explains in comments in the script. Be sure to use a valid email address!
- Upload the script to your server. It does not need to be in browsable webspace (and probably should not be).
Which User?
You need to decide how the script will be run. This will depend on your FTP log file permissions: if the FTP log is readable only by root then you will need to run the script as root. Otherwise you can run it as an ordinary user of your choice.
Test the Script:
- Connect by SSH to your server and run the script once.
[user@host] php -q ftpcheck.php
If all is well you will not see any output from this command.
- Upload a .php, .pl or .cgi file by FTP.
- Run the script again at the SSH command prompt.
- Check your mail, there should be a message with the FTP log entry of the file you just uploaded.
Alternately, you may follow the suggestion at the bottom of the script to disable the "mail" function and enable the "echo" line during testing. Don't forget to change it back after you're done testing!
Create the Cron Job:
If the script needs to run as root, then you will need to edit root's crontab. If you will be running the script as an ordinary user, then you will edit that user's crontab.
The crontab entry you create will look something like this:
15 */6 * * * php -q /path/to/ftpcheck.php > /dev/null 2>&1
This would run the script every 6 hours, at quarter past the hour. You may of course change the frequency to your liking.
Download
Here is the script as a plain text file: ftpcheck.txt. Save it as "ftpcheck.php".
Terms & Conditions
You are free to use, modify and redistribute this script. If you improve on it I'd appreciate hearing about it!
Liability:
The author assumes no liability for damage or loss that might be associated with the use of this script.
Liability:
The author assumes no liability for damage or loss that might be associated with the use of this script.
Bug Reports & Feedback
labradordata
ca-- Doug Robbins
