Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Linux Fedora Core - SSH logs??

Posted on 2006-12-01
12
Medium Priority
?
1,105 Views
Last Modified: 2013-12-06

Can someone provide me with a step by step guide on how to record user actions and authentications (possibly logging access denied and user granted) using SSH on Fedora Core.

I’ve been through /var/logs/ and there doesn’t seem to be anything obvious that I can view!

Any suggestions would be much appreciated, thanks!
0
Comment
Question by:the_omnific
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
12 Comments
 
LVL 4

Expert Comment

by:wbstech
ID: 18052514
You need to be looking for:

/var/logs/sshd
/var/logs/secure

Could you post up /etc/syslog.conf from your Linux machine?

That's where you'll need to add it. Once you post it up, i'll be able to post it back with the required additions. Or tell you where it is, if already there.
0
 
LVL 14

Expert Comment

by:ygoutham
ID: 18052523
you can only see who logged in and out from /var/log/secure.  what do you mean by recording user actions???  i do not think that you can record something of that nature like capturing every command issued and stuff like that.
0
 
LVL 14

Expert Comment

by:ygoutham
ID: 18052527
once you see the user logging in and out, you can probably get the information on the set of commands issued by the user from

/home/user_name/.history

that file will show all commands issued by the user (atleast 1000 commands), but will not give you any idea about when the commands were issued.
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 4

Expert Comment

by:wbstech
ID: 18052532
Didn't fully grasp what you were asking there. Yeh ygoutham is right; the logs aren't going to record everything. Just authentication and errors really.
0
 
LVL 1

Author Comment

by:the_omnific
ID: 18052543
this is my syslog.conf.......

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                          /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none            /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                    /var/log/secure

# Log all the mail messages in one place.
mail.*                                          -/var/log/maillog


# Log cron stuff
cron.*                                          /var/log/cron

# Everybody gets emergency messages
*.emerg                                          *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                    /var/log/spooler

# Save boot messages also to boot.log
local7.*                                    /var/log/boot.log
0
 
LVL 1

Author Comment

by:the_omnific
ID: 18052566
i just thought it might have been interesting to view the logon attempts....i dont necessarily require the need to know every command a user performs once they have access. It would just be nice to know what was going on etc.
0
 
LVL 4

Expert Comment

by:wbstech
ID: 18052592
Try running:

cat /var/log/secure

I think they should already be in there.
0
 
LVL 1

Author Comment

by:the_omnific
ID: 18052662
Thanks, there seems to be all sorts of logon information in there including ftp etc. Is there any way of creating a separate log file solely for SSH?
0
 
LVL 14

Assisted Solution

by:ygoutham
ygoutham earned 500 total points
ID: 18052712
you can try

cat /var/log/secure | grep sshd

which should filter only sshd related info. but again you have only ipaddresses and times, with some stuff on public key acceptance and other things. it also have the user name between ACCEPTED PASSWORD FOR XXXXXX from x.y.z.a

look through that and the history should give some specific idea
0
 
LVL 4

Accepted Solution

by:
wbstech earned 500 total points
ID: 18052740
Try adding the below to the end of the syslog.conf:

#Save only auth info to authinfo.log

authpriv.info                                          /var/log/authinfo.log


Or, you could do the above suggestion and just put "cat /var/log/secure | grep sshd" in a file as below:

echo "cat /var/log/secure | grep sshd" > /usr/bin/showsshdlogs

Then you have in a sense made your own command to show what you need. You can just type "showsshdlogs" at the command prompt and see it all.
0
 
LVL 1

Author Comment

by:the_omnific
ID: 18052747
Thank you very much. Both of you have been very informative!
0
 
LVL 4

Expert Comment

by:wbstech
ID: 18052784
No problem :-)
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will explain how to establish a SSH connection to Ubuntu through the firewall and using a different port other then 22. I have set up a Ubuntu virtual machine in Virtualbox and I am running a Windows 7 workstation. From the Ubuntu vi…
The purpose of this article is to fix the unknown display problem in Linux Mint operating system. After installing the OS if you see Display monitor is not recognized then we can install "MESA" utilities to fix this problem or we can install additio…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
Suggested Courses

598 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question