0

I have an ubuntu 14.04 server running a service, and I'm currently setting up some logging visualization, but I noticed my /var/log/auth.log is empty.

I assumed it wouldn't have much since I've disabled ssh connections other than using an ssh key. But, I did expect there to be sshd logs. Is there somewhere else that I would see the logins using ssh keys, or is there something else happening I'm unaware of?

My ultimate goal is to have a log of every time someone tries to login using the key, or without the key.


EDIT1

I see that there are auth.log backups, but they aren't recording ssh attempts, or successful ssh logins using keys. They only show CRON jobs.

I also elevated the sshd_config logging level to VERBOSE instead of INFO.

1

In Ubuntu systems rsyslog handles system logging, redirecting output from several daemons (such as sshd) to their respective logs according to its config.

There are several config files that could affect the usage of the log file. I would start by debugging rsyslog, first checking its config at /etc/rsyslog.d (more likely, 50-default.conf) and looking for a line that should look something like this:

auth,authpriv.*         /var/log/auth.log

If it's not set up to /var/log/auth.log, then you just found the problem, the output is going somewhere else. If not...

Next, check that rsyslog is actually running with systemctl status rsyslog, if it's not, it is possible something disabled it or it's not even present as a service, you can re enable (if it's there) the daemon with systemctl enable rsyslog.

Also, your sshd config could be either disabling logging completely or overwriting rsyslog's configuration, check for SyslogFacility inside your sshd.conf, which could be redirecting the messages to another rsyslog facility, by default it should be AUTH (as the line in the first step config). Of course, LogLevel is also important, but you got it in VERBOSE, so that shouldn't be the problem.

For debugging sshd, you could try putting it on debug mode with -d, as stated on man:

Debug mode. The server sends verbose debug output to standard error, and does not put itself in the background. The server also will not fork and will only process one connection. This option is only intended for debugging for the server. Multiple -d options increase the debugging level. Maximum is 3.

Be careful while tweaking sshd if you are on a sshd connection as you could, of course, end up locked off the remote machine.

  • Thanks for your incredibly detailed and thorough answer. In my case, rsyslog was disabled for some reason. Thanks again, – trueCamelType Feb 7 '18 at 19:17
2

Another reason could be wrong ownership of the file.

Check the ownership of the file - /var/log/auth.log

If it's not owned by syslog:adm , then change it to syslog:adm

sudo chown syslog:adm /var/log/auth.log

This fixed the issue for me in Ubuntu.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.