0

The following message showed up in my logwatch:

--------------------- SSHD Begin ------------------------ 

SFTP subsystem requests: 1 Time(s)

 ---------------------- SSHD End ------------------------- 

I understand that it means SFTP has been accessed, but does it mean that an active connection was made, or that it was only attempted? Would there be an alternative message if a connection had been attempted but failed?

1 Answer 1

2

Only successful login attempt via sftp yourusername@yourservername are logged into /var/log/auth.log marked with

TIMESTAMP SERVERNAME sshd[xxxx] subsystem request for sftp

which in turn is parsed by logwatch to show the count i.e. successful SFTP login counts

Unsuccessful attempts for sftp is not differentiated from normal ssh failure attempts in the log file. If you're using something like a GUI SSH/SFTP client on windows/osx/linux, and copied a file across, that'd generate that log entry.

If you haven't done any file copies at all, then you might want to poke at the box a bit.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .