0

after some tinkering with rsyslog, sshd no longer logs information about failed login attempts to syslog for some reason. I've returned both sshd and rsyslog configs back to where it was:

rpm -V $(rpm -qf /etc/ssh/sshd_config)
rpm -V $(rpm -qf /etc/rsyslog.conf)

both produce empty output.

however there is still nothing in /var/log/secure, and journalctl -u sshd shows only:

Oct 02 12:59:29 server04.company.name systemd[1]: Starting OpenSSH server daemon...
Oct 02 12:59:29 server04.company.name systemd[1]: Started OpenSSH server daemon.

(in case you're wondering: I made failed login attempt to check this.)

has anyone encountered the same weird behavior?

0

This happens when you re-create the /var/log/secure file. This will break file permissions, especially if SELinux is enabled.

Do the following:

Make sure /var/log/secure is owned by root:root

$ sudo chown root:root /var/log/secure

Make sure the permission is set to 600

$ sudo chmod 600 /var/log/secure

If SELinux is enabled, you can temporarily disable while troubleshooting your issue

$ sudo setenforce 0

If you decide to keep SELinux enabled, make sure the file has the following context:

$ ls -lZh /var/log/secure
system_u:object_r:var_log_t:s0

To manipulate SELinux on the fly (copy context from an existing known working):

$ sudo chcon --reference /var/log/dmesg /var/log/secure

To manipulate SELinux context permanently, use semanage command instead

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.