Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to keep a log of the files copied using SCP? I am administering a server which contains some files that should be monitored (in a specific folder and its subfolders), so when someone copies them via SSH, the copying process should be logged.

I thought of looking into the Bash command history of users and search for commands that start with scp, but that's blatant invasion of privacy and it's also very easy for users to delete this history (even without bad intent).

Does anyone know a way for this? I can make a web-based interface to the server with usernames/passwords and logging downloads would be easy then, but I'm interested in a "bare metal" solution, if there's one.

EDIT: I looked over SSHD's logging options, like FascistLogging, or Debug logging, but those didn't seem very appropriate. Are they actually the solution?

EDIT 2: I'm beginning to believe that this question shouldn't be on Stack Overflow, but rather on Server Fault... What should I do?

share|improve this question

migrated from stackoverflow.com May 23 '12 at 8:22

This question came from our site for professional and enthusiast programmers.

1  
Nothing, it has already been migrated by a moderator. –  Silviu May 23 '12 at 8:28
add comment

4 Answers

up vote 1 down vote accepted

I would use incron. It utilizes Linux kernel inotify subsystem and if some monitored directory tree / file gets modified, you can execute anything you want. The incrontab file format is very straightforward, for example

/your/directory IN_MODIFY /usr/local/bin/log_file_modifications.sh $@/$#

would run /usr/local/bin/log_file_modifications.sh every time something gets modified at /your/directory directory tree, calling the script with the full path ($@ argument) and the file that got modified ($# argument).

Your script could be about as simple as

#!/bin/bash
logger -t modification_stalker "Yo dawg, these files got modified $1 $2 ..." 
share|improve this answer
    
I didn't think about this, awesome! I kept postponing delving into inotify, I never thought it's that easy. +1 (if I had enough rep) –  CamilB May 23 '12 at 9:03
add comment

sshd option is useless here. scp just run something like 'scp -t -- dest_file' on remote host.

Simpliest way - create wrapper around real scp program, for logging command-line arguments.

share|improve this answer
    
There's a problem with that: scp will be executed by the users on their computers, while I want the log on the server. And unfortunately I cannot wrap scp, nor change scp itself on their computers. That's why I thought sshd was supposed to do the logging... –  Camil Bancioiu May 23 '12 at 7:08
    
@CamilB But modofocation on the server should be feasible? –  glglgl May 23 '12 at 9:27
    
@glglgl: Yes, I've set up the server myself and I can change everything. –  CamilB May 23 '12 at 16:47
    
@CamilBancioiu Fine! So that's all you need. –  glglgl May 24 '12 at 6:08
add comment

OpenSSH supports logging of scp. So if you turn it on VERBOSE mode you will even see the directories your clients traversed.

To see the log check

/var/log/auth.log
share|improve this answer
    
I'll check this soon, thanks! –  CamilB May 23 '12 at 9:04
    
@Silviu - setting LogLevel VERBOSE does not log files or directory transfers in /var/log/auth.log –  Martin Vegter Jun 10 at 22:33
add comment

You can set up verbose logging level for sshd and use some audit software, e.g. auditd to create reports based on log messages.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.