1
vote
2answers
83 views

How to log ssh client connection/command?

I would like to know how i could log SSH command lines a user is using on a server. For exemple, if the user Alex on my server is doing the following set of commands : $ cd /tmp $ touch myfile $ ssh ...
-2
votes
2answers
48 views

FTP and SFTP logs track in CentOS

How it is possible to track the changes made to a directory using tools like FileZilla or XFTP ? because we found some files suddenly got missed from server, in history also nothing was found so ...
3
votes
3answers
132 views

Reuse remote ssh connections and reduce command/session logging verbosity?

I have a number of systems that rely on application-level mirroring to a secondary server. The secondary server pulls data by means of a series of remote SSH commands executed on the primary. The ...
5
votes
4answers
82 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
0
votes
1answer
41 views

How to check last FTP logins using SSH?

I've just bought a new VPS (its operating system is CentOS). As this is my first experience with VPS, I don't know everything about managing and ... One of my customers told me his website is not ...
3
votes
3answers
1k views

Log commands executed over ssh

I would like to log all commands executed over SSH. Say, ssh something@server.com COMMAND I want to log "COMMAND" on server.com I did search extensively but could not find anything. There is ...
0
votes
0answers
64 views

Does OpenSSH server log any connection attempts?

When I logged to my VPS server I noticed an established connection on port 22. The IP address was not mine. The connection lasted about a minute and then was closed. I could not find any logs ...
0
votes
1answer
98 views

Logging remote commands sent during SSH session, so the log would be unencrypted

I connect to server A (running OpenSSH server in Linux OS) using Putty: localhost% putty.exe A How to cause the SSH server to log the commands sent from localhost in unencrypted manner. Thanks
-1
votes
1answer
102 views

Where is ssh daemon log file

I am facing a strange issue on my Centos 5.5 VMware virutal machine. SSHD service stops responding after working for few days. At the same time cmd>telnet server 22 give me no response. It works ...
4
votes
2answers
315 views

iptables SSH connection logging

Is it possible to only write a log-entry when a connection is established ? I have tried: iptables -I OUTPUT -p tcp --dport 22 -j LOG --log-level notice --log-prefix "outgoing ssh connection" to ...
1
vote
2answers
619 views

What do these entries in my SSH logs mean? [duplicate]

I recently noticed that I have entries from an unknown IP address in my SSH logs. I performed a grep to extract all entires that didn't contain my own IP address. I was presented with this: Jul 24 ...
3
votes
1answer
342 views

Is it possible to force SFTP rather than allow SCP fallback ?

I have a Red Hat 5.4 server with openssh OpenSSH_4.3p2 and have been trying to setup scp/sftp logs in my server, but I am running into some problems. I followed the directions in this other post. ...
1
vote
2answers
510 views

MYSQL logs of user activity by IP address [duplicate]

I have a website to which I have allowed someone to enter to make some modifications. However, I have discovered that they made changes that compromised the security of the website and I know that the ...
0
votes
2answers
600 views

Enable logging for SSH session on Brocade FCX Switch

On my Brocade FCX switch, I'm able to see syslog messages in-line when I'm using a console cable by running the command logging console from the configuration menu. However, when I SSH in, I'm unable ...
1
vote
2answers
1k views

How do I list the N last successful and unsuccessful login attempts for my user when I log in with e.g. ssh on Linux?

This seems like such a basic security feature I'm surprised it's not already standard.
0
votes
1answer
62 views

SSH logging to MySQL Database parallel to auth.log

As the title says, is there any way to force sshd logging (of authentication failures) to a MySQL table in addition to the /var/log/auth.log file ? *My Server is Debian Squeeze, openssh, mysql5, ...
1
vote
2answers
3k views

/var/log/auth.log not logging failed ssh attempts

I'm trying to go failed (either incorrect username, password, or both) on my server. I changed /etc/ssh/sshd_config from # Logging SyslogFacility AUTH LogLevel INFO to # Logging SyslogFacility ...
1
vote
1answer
117 views

Fix SSH (client and server) on Mac OS X Mountain Lion

I have upgraded my Mac to Mountain Lion. Now that its complete I cannot SSH into any server for more than a few seconds, and I cannot receive any SSH connections. I can only assume something from the ...
5
votes
1answer
855 views

How to list current sshfs mounts to server?

If someone logs into a server via ssh for shell usage, a quick use of last|w|who can be used to show the logged in user. If someone mounts a directory on the same server via sshfs from another ...
0
votes
4answers
3k views

Monitor file copies with SCP done via SSH

Is there a way to keep a log of the files copied using SCP? I am administering a server which contains some files that should be monitored (in a specific folder and its subfolders), so when someone ...
4
votes
2answers
284 views

From log file into terminal in realtime

I'm on Ubuntu. Is it possible to open putty and watch as a log file updates right in terminal? Like if stdout would have been directed in terminal? For example I have one application's stdout and ...
6
votes
1answer
116 views

Determine when someone last logged in to a server from a key

I'm trying to track the last time a user logged into a Linux server with a certain key. So user secure has 5 keys in ~/.ssh/authorized_keys, how can I track when each key was used and what IP was used ...
0
votes
1answer
3k views

sshd not writing any kind of log Debian 6

I just installed Debian 6 on my server and noticed that sshd isn't writing any log to /var/log. I understand this is a huge security issue as I won't be able to know who logged in to my server. Is ...
3
votes
2answers
235 views

Suspicious password login in sshd log

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey. Today when I check the log file, ...
4
votes
2answers
3k views

How to log every login (SSH) on FreeBSD

I want to log every SSH login attempts, both successful and not, to my FreeBSD server to a file, and daily mail this log to root. I could accomplish something like this by parsing /var/log/auth.log, ...
0
votes
3answers
144 views

Using SSH to find access to a problematic script in logs of multiple domains

I run several (~20) sites on a Dreamhost VPS. Lately I max my memory allocation for the VPS and I want to find the problem. I would like to have an SSH script that will scan all the log files of all ...
123
votes
4answers
4k views

Is my password compromised because I forgot to hit Enter after ssh username?

I've just tried logging into a Fedora (release 13 Goddard) server using SSH (PuTTY, Windows). For some reason the Enter after typing my username didn't go through and I typed in my password and hit ...
0
votes
2answers
95 views

Display specific word in file. To be used as varible, grep for email in log

I'm looking to display just the email address in the /var/log/secure file. The email goes into a variable, so just grepping for lines won't work. I know how to string together sed commands, but is ...
1
vote
3answers
301 views

Ssh log monitor

Are there any tools to monitor ssh logs at /var/log/secure and report activity? I am looking for some tools that will proactively tell me about user actions and highlight malicious activity. I don’t ...
5
votes
1answer
1k views

SSH session logging

We have a policy of logging all SSH session activity for CYA purposes with our clients. With PuTTY under windows this is trivial, as we can log each session to a file using PuTTY's built-in logging ...
14
votes
4answers
4k views

Is it possible to get OpenSSH to log the public key that was used in authentication?

I have a production system where several different people are allowed to log in to a single account - the account is for the application and not for the person as we don't have personal accounts on ...
-4
votes
1answer
138 views

I got Putty installed need to SSH to my webhost to get MYSQL Error logs [closed]

I need the exact commands to type from the beginning in putty to first connect to my db and then to get the error logs contained in /var/lib/mysql/HOSTNAME.err file. Thanks
2
votes
1answer
610 views

Via logwatch, I get messages that root is opening sessions “-> nobody”. Is this a security concern, or normal operation?

Here are some lines from logwatch: pam_unix sshd: Authentication Failures: root (211.167.103.115): 5 Time(s) unknown (219.239.110.139): 1 Time(s) Invalid Users: Unknown Account: 1 ...
1
vote
3answers
950 views

Is there a possibility to “pimp” Putty in order to generate logs automatically and run multiple sessions in one windows (similar Linux “Terminal”)?

I'm using Putty for Serial or SSH connections to systems. For every session, I need to configure Logging manually, enter a new name and destination. I was wondering if there was a solution to set it ...
9
votes
3answers
2k views

Logging a “persons” activity in Linux

So I've read many of the posts related to this and have just come up more confused than before. There are recommendations for various tools including ttyrec, snoopy, acct, rootsh, sudosh, ttyrpld, ...
1
vote
4answers
153 views

Explanation of my SSH log file please

I'm trying to understand what I'm seeing in my SSH log file so that I can best defend against the bad guys. Particularly interested in understanding the number listed after "port" in the log. Here is ...
0
votes
2answers
201 views

Linux: Where are non-interactive commands logged?

As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection, rsync -avz -e ...
5
votes
2answers
12k views

Debian: logging of SSH failed login attempts?

I just typed a wrong password for login to ssh @ root. I went to /var/log/faillog But the file is empty ( tho its filesize is: 32 Byte ) Ok in auth.log is spammed this: reverse mapping checking ...
1
vote
1answer
2k views

Simple SFTP transfer log [duplicate]

I am looking for a way to log transfers over SFTP in Ubuntu. Nothing complicated, just a log where I can see which users have down/uploaded certain files. I read this but setting the -l INFO flag in ...
1
vote
1answer
323 views

Turn “log slow queries” ON

I'm trying to log mysql slow queries, but I can't turn it on. I will explain all my steps: Open and Edit my.cnf and add the following lines: long_query_time = 5 slow_query_log_file = ...
1
vote
2answers
875 views

Best tools for “ssh tail -f” style log file monitoring and analysis

I'm looking for a tool to monitor custom PHP Error logs/Apache and possibly Java logs on remote development servers. I'm not looking for a full production log system like Splunk, but something that's ...
1
vote
2answers
135 views

Server logging goes haywire and some system services die until hard reboot

The gist of our problem is that we lose ssh access to our VPS and our logfiles get all mixed up. Doing a hard reboot through our hosting provider's web console seems to fix things, but the problem ...
0
votes
4answers
692 views

How to detect that remote ssh session started from external network?

How can I setup monit to notify me about new remote SSH sessions that originate from outside one specific subnet? I've considered logging connection attempts as part of a ~/.bashrc script but I'm not ...
2
votes
2answers
1k views

Can tail slow down log writing speed on Linux (ext3)?

I'm wondering if tailf can generate blocking I/O which will slow down server responsiveness due to logging. For ex. assuming the following setup: Debian 5.1 linux server (foo) which is managed via ...
1
vote
1answer
1k views

shell / ssh / tty session logger

Good day to you. I know there's some variations of my question here, but they are a bit different I assure you. We use terminal servers that our admins connect to and then establish ssh ...
1
vote
3answers
169 views

Giving supplier root access to server, and logging it?

One of our suppliers needs to debug a problem with an application by logging remotely into one of our servers. They'll need to have root access, which I plan to provide via ssh and sudo. I generally ...
8
votes
7answers
4k views

BASH shell session logging on remote host

What's the best method of logging a BASH shell session to a file on the host machine? The preferred output format would be equivalent to PuTTY's "printable output" log setting, as viewed by the user ...
7
votes
3answers
2k views

Is SSH logging capabilities equivalent to su logging for private/public key authentication?

Here at work, we have a non-root shared login account on UNIX that is used to admin a particular application. The policy is to not allow direct logins to the shared account; you must login as yourself ...