Can someone please tell me where to find the SSHD log on RedHat and SELinux.... I would like to view the log to see who is logging into my account..
Login records are usually in /var/log/secure. I don't think there is a log specific to the SSH daemon process, unless you've broken it out from other syslog messages.
In addition to @john answer, some distributions are now using journalctl by default. If that's your case, you're probably able to see
sshd activity through:
_> journalctl _COMM=sshd
You will see output like this:
Abr 15 02:28:17 m sshd: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root" Abr 15 02:28:18 m sshd: Failed password for root from 127.0.0.1 port **** ssh2 Abr 15 02:28:19 m sshd: Connection closed by 127.0.0.1 [preauth] Abr 15 02:28:25 m sshd: Accepted password for **** from 127.0.0.1 port **** ssh2 Abr 15 02:28:25 m sshd: pam_unix(sshd:session): session opened for user **** by (uid=0) Abr 15 02:28:28 m sshd: Received disconnect from 127.0.0.1: 11: disconnected by user Abr 15 02:28:58 m sshd: Received signal 15; terminating. Abr 15 02:28:58 m sshd: Server listening on 0.0.0.0 port 22.
The log is in fact located at /var/log/secure on RHEL systems. A SSHD connection will look something like this;
Jan 10 09:49:04 server sshd: Accepted publickey for [username] from x.x.x.x port 61000 ssh2 Jan 10 09:49:04 server sshd: pam_unix(sshd:session): session opened for user [username] by (uid=0)
The most important part for determining whether or not your account has been compromised is the IP Address.
If you are using RHEL/CentOS 7, your system will be using systemd, and therefore journalctl. As mentioned above, you can use the
journalctl _COMM=sshd. However, you should also be able to view this with the following command:
# journalctl -u sshd
You can verify your version of redhat by the following command as well:
# cat /etc/*release
This will show you version information about your version of linux.