3

Is there a way to keep a log of the files copied using SCP? I am administering a server which contains some files that should be monitored (in a specific folder and its subfolders), so when someone copies them via SSH, the copying process should be logged.

I thought of looking into the Bash command history of users and search for commands that start with scp, but that's blatant invasion of privacy and it's also very easy for users to delete this history (even without bad intent).

Does anyone know a way for this? I can make a web-based interface to the server with usernames/passwords and logging downloads would be easy then, but I'm interested in a "bare metal" solution, if there's one.

EDIT: I looked over SSHD's logging options, like FascistLogging, or Debug logging, but those didn't seem very appropriate. Are they actually the solution?

EDIT 2: I'm beginning to believe that this question shouldn't be on Stack Overflow, but rather on Server Fault... What should I do?

1
  • 1
    Nothing, it has already been migrated by a moderator.
    – Silviu
    May 23, 2012 at 8:28

5 Answers 5

9

I would use incron. It utilizes Linux kernel inotify subsystem and if some monitored directory tree / file gets modified, you can execute anything you want. The incrontab file format is very straightforward, for example

/your/directory IN_MODIFY /usr/local/bin/log_file_modifications.sh $@/$#

would run /usr/local/bin/log_file_modifications.sh every time something gets modified at /your/directory directory tree, calling the script with the full path ($@ argument) and the file that got modified ($# argument).

Your script could be about as simple as

#!/bin/bash
logger -t modification_stalker "Yo dawg, these files got modified $1 $2 ..." 
1
  • I didn't think about this, awesome! I kept postponing delving into inotify, I never thought it's that easy. +1 (if I had enough rep)
    – CamilB
    May 23, 2012 at 9:03
1

sshd option is useless here. scp just run something like 'scp -t -- dest_file' on remote host.

Simpliest way - create wrapper around real scp program, for logging command-line arguments.

4
  • There's a problem with that: scp will be executed by the users on their computers, while I want the log on the server. And unfortunately I cannot wrap scp, nor change scp itself on their computers. That's why I thought sshd was supposed to do the logging...
    – Camil Bancioiu
    May 23, 2012 at 7:08
  • @CamilB But modofocation on the server should be feasible?
    – glglgl
    May 23, 2012 at 9:27
  • @glglgl: Yes, I've set up the server myself and I can change everything.
    – CamilB
    May 23, 2012 at 16:47
  • 1
    @CamilBancioiu Fine! So that's all you need.
    – glglgl
    May 24, 2012 at 6:08
1

OpenSSH supports logging of scp. So if you turn it on VERBOSE mode you will even see the directories your clients traversed.

To see the log check

/var/log/auth.log
1
  • 1
    @Silviu - setting LogLevel VERBOSE does not log files or directory transfers in /var/log/auth.log Jun 10, 2014 at 22:33
1

I realise now this is only sftp and not scp as originally requested however I'm leaving the answer here to help people.

Been trying to find the answer to this myself so here goes.

Firstly, you need to enable logging of the sftp subprogram that ssh uses:

In /etc/ssh/sshd_config

Subsystem   sftp    /usr/libexec/openssh/sftp-server -l INFO

Then restart sshd however your particular distribution does it:

service sshd restart

Now we you should see scp log messages appearing in something like /var/log/messages, or maybe /var/log/auth.log depending on your syslog setup.

I'm using syslog-ng and want my logs for sftp transfers separate from the rest of the logs for ssh.

In /etc/syslog-ng/syslog-ng.conf:

#sftp configuration
destination sftp { file("/var/log/sftp.log"); };
filter f_sftp { program("sftp-server"); };
log { source(s_src); filter(f_sftp); destination(sftp); };

This means logs now go to /var/log/sftp.log - you may need to edit program("sftp-server") to match whichever program you're using in SSH as there is various options

Finally, to stop the logs also going into the ssh log, we filter them out:

        filter f_auth { facility(auth, authpriv) and not filter(f_debug) and not filter(f_sftp); };

Restart syslog-ng (or your syslog daemon): * When I tried just reloading the changes didn't work, I had to restart it.

service syslog-ng restart
2
  • it seems this answer is not completely correct. connecting via SFTP is not equal to connecting via SCP. As how this differs in the logging directly i do not know. Oct 29, 2015 at 8:55
  • @DennisNolte I realise they aren't the same in that way, I've only just realised filezilla is claiming to use sftp and not scp as I presumed it was. I'll update my answer to be sftp specific. Oct 29, 2015 at 11:04
0

You can set up verbose logging level for sshd and use some audit software, e.g. auditd to create reports based on log messages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .