up vote 0 down vote favorite
share [g+] share [fb]

I just installed Debian 6 on my server and noticed that sshd isn't writing any log to /var/log. I understand this is a huge security issue as I won't be able to know who logged in to my server. Is there anyway to fix this?

link|improve this question
89% accept rate
feedback

1 Answer

up vote 4 down vote accepted

By default, sshd's SyslogFacility is set to AUTH.

If you haven't changed this in /etc/ssh/sshd_config, you should be getting sshd log information in /var/log/auth.log. You'll also see messages here from pam and sudo, so all access information is logged in the same place.

link|improve this answer
Looks good in sshd_config: # Logging SyslogFacility AUTH LogLevel INFO /var/log/auth.log doesn't exist. – David Dec 30 '11 at 16:37
2  
Odd. All auth messages go there by default. You could check /etc/rsyslog.conf to confirm that it hasn't been directed elsewhere. Are your other logs being updated correctly? Is rsyslogd running? – eaj Dec 30 '11 at 16:45
Thank you so much! Yep you're right, for some reason rsyslogd isn't even installed. I installed rsyslogd and the ssh access log is in auth.log like you said. Is there a way to install all of essential packages? I had to install nano and tcpdump as it isn't included in my version of Debian. I think the version of Debian I have is the bare minimum. – David Dec 30 '11 at 17:05
I haven't gone through the installation recently, but I'd expect any default configuration to include rsyslogd. Unless it's really bare-bones, I'd just install things as you need them. Pretty soon you'll find it's all there. – eaj Dec 30 '11 at 17:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.