Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just installed Debian 6 on my server and noticed that sshd isn't writing any log to /var/log. I understand this is a huge security issue as I won't be able to know who logged in to my server. Is there anyway to fix this?

share|improve this question
add comment

1 Answer 1

up vote 5 down vote accepted

By default, sshd's SyslogFacility is set to AUTH.

If you haven't changed this in /etc/ssh/sshd_config, you should be getting sshd log information in /var/log/auth.log. You'll also see messages here from pam and sudo, so all access information is logged in the same place.

share|improve this answer
    
Looks good in sshd_config: # Logging SyslogFacility AUTH LogLevel INFO /var/log/auth.log doesn't exist. –  David Dec 30 '11 at 16:37
3  
Odd. All auth messages go there by default. You could check /etc/rsyslog.conf to confirm that it hasn't been directed elsewhere. Are your other logs being updated correctly? Is rsyslogd running? –  eaj Dec 30 '11 at 16:45
    
Thank you so much! Yep you're right, for some reason rsyslogd isn't even installed. I installed rsyslogd and the ssh access log is in auth.log like you said. Is there a way to install all of essential packages? I had to install nano and tcpdump as it isn't included in my version of Debian. I think the version of Debian I have is the bare minimum. –  David Dec 30 '11 at 17:05
    
I haven't gone through the installation recently, but I'd expect any default configuration to include rsyslogd. Unless it's really bare-bones, I'd just install things as you need them. Pretty soon you'll find it's all there. –  eaj Dec 30 '11 at 17:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.