5.2 Turn on additional logging for FTP daemon - Check if file /etc/inet/inetd.conf exists.

Information

If the FTP daemon is left on, it is recommended that the 'debugging' (-d) and connection logging (-l) flags also be enabled to track FTP activity on the system. Note that enabling debugging on the FTP daemon can cause user passwords to appear in clear-text form in the system logs, if the user accidentally types their password at the username prompt. Information about FTP sessions will be logged via Syslog, but the system must be configured to capture these messages.

See Also

https://workbench.cisecurity.org/files/633