Where do I find the sshd log in Ubuntu 12.04

Question

I have a fresh install of Ubuntu 12.04. I'm trying to setup ssh public key authentication. Unfortunately, it refuses to work. Running the ssh client in verbose mode I can see that the public keys are being refused.

~/.ssh/authorized_keys exists and seems to have the correct permissions etc.

What I would like to do is to read the sshd log to find out what it is complaining about. But I cannot find where the sshd logs to on Ubuntu 12.04. I've tried googling and checked /var/log/auth.log and /var/log/syslog and neither are showing sshd messages. Where can I find the daemon logs to figure out what is going on?

Thanks.

Answer 1

sshd generally logs via syslog. By default it looks to the AUTH or AUTHPRIV facility, although you can modify this via the SyslogFacility configuration option in your sshd_config file.

To figure out where syslog messages go, look in /etc/syslog.conf, which contains lines similar to:

authpriv.*          /var/log/secure

This example would send all AUTHPRIV messages to /var/log/secure. You'll find something similar on your system.

Answer 2

Actually it should be in /var/log/auth.log indeed:

root@ubu12:/var/log# fgrep ssh auth.log|wc -l
64

In addition — /etc/ssh/sshd_config:

…
# Logging
SyslogFacility AUTH
LogLevel INFO
…

But you can try checking and altering /etc/rsyslog.d's content — 50-default.conf has commented out entry which could be useful for debug purpose:

#daemon.*                       -/var/log/daemon.log

Finally there's another option — running sshd in debug mode -d:

The server sends verbose debug output to standard error, and does not put itself in the background. The server also will not fork and will only process one connection. This option is only intended for debugging for the server. Multiple -d options increase the debugging level. Maximum is 3.

— see man sshd and other pages.