I am exploring ways to capture all the incoming SSH and SFTP login information [ machine name and the user ] to my Oracle Linux 5.x server.

I am relying on the /etc/syslog.conf to capture this information.

Currently I am using /etc/syslog.conf as

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

local1.info     /log_saves/FTP_LOG
local2.warning  /log_saves/FTP_LOG
LOCAL7.debug    /log_saves/SFTP_LOG
LOCAL7.debug    /log_saves/SFTP_LOG

With the above configuration, I am able to capture all the FTP logins to my server to /log_saves/FTP_LOG but the SFTP/SSH inf is not recorded in /log_saves/FTP_LOG or /log_saves/SFTP_LOG Is there any way/alternative/demon I could utilize to capture the SFTP/ SHH information

  • Please clarify. What do you want to record? Just the login event, or the credentials? – Roman Feb 21 '13 at 15:58
  • I am looking to record the login event – Balualways Feb 21 '13 at 16:05

The log facility for ssh is AUTHPRIV. So you need the following entry in your /etc/syslog.conf :

 authpriv.*    /var/log/secure

You can change the log file location.

As far as the log level is concerned, you can change it in the sshd config file - sshd_config with the LogLevel parameter.

  • I'd better not shuffle the logs around, just set up to grep(1) them out as needed. – vonbrand Feb 21 '13 at 19:15
  • I have configured my /etc/ssh/sshd_config as "Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL7 -l INFO" and I have /etc/syslog.conf entry as "LOCAL7.debug /log_saves/sftplog/sftplog" but it is not capturing the sftp-server events. But it does capture the sshd/crond/rshd/login events. Am I mssing something here – Balualways Feb 26 '13 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.