I have been trying to log SFTP activity by Chrooted user.
I have not been able to log a single line so far for any chrooted user. For regular users it works.
My current settings:
Subsystem sftp internal-sftp -f AUTH -l VERBOSE ClientAliveInterval 180 PasswordAuthentication no Match Group sftpclients ChrootDirectory /home/sftp/%u AllowTCPForwarding no X11Forwarding no ForceCommand internal-sftp -f AUTH -l VERBOSE
$AddUnixListenSocket /home/sftp.log.socket $AddUnixListenSocket /home/sftp/dev/log.socket $AddUnixListenSocket /home/sftp/user1/dev/log.socket $AddUnixListenSocket /home/sftp/user2/dev/log.socket :programname, isequal, "internal-sftp" -/var/log/sftp2.log :programname, isequal, "internal-sftp" ~
input(type="imuxsock" Socket="/home/sftp/log2.socket" CreatePath="on") if $programname == 'internal-sftp' then /var/log/sftp3.log
Each user has their //dev/ directory bound to /dev:
mount --bind /dev /home/sftp/<user>/dev as well as the sockets defined in
Question I have tried basically every suggestion I have found, what might I be missing in my setup to log chrooted users?