From: "Marc J. Miller" <[email-masked]>
Date: Fri, 10 Nov 2000 03:22:11 -0800

I asked my department to help me with a log test (I'm building a log parser 
which will generate statistics we need for reports to get our funding from 
tax dollars). Some of them got a bit creative yesterday.

Nov 8 13:42:55 lm-linux2 afpd[27166]: ASIP session:548(2) from 
169.237.151.144: 49176(0)
Nov 8 13:42:55 lm-linux2 afpd[27166]: dhx login: itlm081
Nov 8 13:42:55 lm-linux2 afpd[27166]: logout itlm081
Nov 8 13:42:55 lm-linux2 afpd[27166]: 0.10KB read, 0.12KB written
Nov 8 13:42:55 lm-linux2 afpd[26226]: server_child[1] 27166 done

At a glance, it probably looks pretty normal, so compare to this normal login:

Nov 8 14:56:03 lm-linux2 afpd[27255]: ASIP session:548(2) from 
169.237.151.144: 49156(0)
Nov 8 14:56:03 lm-linux2 afpd[27255]: dhx login: itlm081
Nov 8 14:56:03 lm-linux2 afpd[27255]: login itlm081 (uid 1457, gid 20)
Nov 8 14:56:10 lm-linux2 afpd[27255]: logout itlm081
Nov 8 14:56:10 lm-linux2 afpd[27255]: 2.64KB read, 17.44KB written
Nov 8 14:56:10 lm-linux2 afpd[26226]: server_child[1] 27255 done

In short, the line "dhx login:" appears whenever a login is attempted.  It 
shows that the login data is being sent to the Diffie-Hellman eXchange UAM. 
The "login itlm081" shows that itlm081 successfully logged in.  Right below 
that is the logout. In the first log segment above, there is a logout 
without a login. I called him up and had him go through the same steps 
today, but we couldn't reproduce it. I went looking for where afp_logout() 
might be called by mistake & found that it only runs if the Mac client 
tells it to run. If it wasn't for the "logout" statement, I'd think it was 
a failed login plain & simple like this one:

Nov 8 13:42:31 lm-linux2 afpd[27160]: ASIP session:548(2) from 
169.237.151.144: 49170(0)
Nov 8 13:42:31 lm-linux2 afpd[27160]: dhx login: itlm110
Nov 8 13:42:33 lm-linux2 afpd[27160]: 0.18KB read, 0.13KB written
Nov 8 13:42:33 lm-linux2 afpd[26226]: server_child[1] 27160 done

ideas?

============================================================
/\/\arc ._|. /\/\iller ([email-masked])
Computer Room Consultant
Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/