Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
In addition to @john answer, some distributions are now using journalctl by default. If that's your case, you're probably able to see
sshd activity through:
_> journalctl _COMM=sshd
You will see output like this:
Abr 15 02:28:17 m sshd: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root" Abr 15 02:28:18 m sshd: Failed password for root from 127.0.0.1 port **** ssh2 Abr 15 02:28:19 m sshd: Connection closed by 127.0.0.1 [preauth] Abr 15 02:28:25 m sshd: Accepted password for **** from 127.0.0.1 port **** ssh2 Abr 15 02:28:25 m sshd: pam_unix(sshd:session): session opened for user **** by (uid=0) Abr 15 02:28:28 m sshd: Received disconnect from 127.0.0.1: 11: disconnected by user Abr 15 02:28:58 m sshd: Received signal 15; terminating. Abr 15 02:28:58 m sshd: Server listening on 0.0.0.0 port 22.
The log is in fact located at /var/log/secure on RHEL systems. A SSHD connection will look something like this;
Jan 10 09:49:04 server sshd: Accepted publickey for [username] from x.x.x.x port 61000 ssh2 Jan 10 09:49:04 server sshd: pam_unix(sshd:session): session opened for user [username] by (uid=0)
The most important part for determining whether or not your account has been compromised is the IP Address.
If you are using RHEL/CentOS 7, your system will be using systemd, and therefore journalctl. As mentioned above, you can use the
journalctl _COMM=sshd. However, you should also be able to view this with the following command:
# journalctl -u sshd
You can verify your version of redhat by the following command as well:
# cat /etc/*release
This will show you version information about your version of linux.
Secure logs get rotated so you may need to search previous files as well.
You may also be interested in searching the logfile for specific lines (I just banged on the keyboard to generate those sample ip addresses so please don't attribute too much meaning to them)
sudo grep -e 22.214.171.124 -e 126.96.36.199 /var/log/secure*