Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1113
  • Last Modified:

Linux Fedora Core - SSH logs??


Can someone provide me with a step by step guide on how to record user actions and authentications (possibly logging access denied and user granted) using SSH on Fedora Core.

I’ve been through /var/logs/ and there doesn’t seem to be anything obvious that I can view!

Any suggestions would be much appreciated, thanks!
0
the_omnific
Asked:
the_omnific
  • 5
  • 4
  • 3
2 Solutions
 
wbstechCommented:
You need to be looking for:

/var/logs/sshd
/var/logs/secure

Could you post up /etc/syslog.conf from your Linux machine?

That's where you'll need to add it. Once you post it up, i'll be able to post it back with the required additions. Or tell you where it is, if already there.
0
 
ygouthamCommented:
you can only see who logged in and out from /var/log/secure.  what do you mean by recording user actions???  i do not think that you can record something of that nature like capturing every command issued and stuff like that.
0
 
ygouthamCommented:
once you see the user logging in and out, you can probably get the information on the set of commands issued by the user from

/home/user_name/.history

that file will show all commands issued by the user (atleast 1000 commands), but will not give you any idea about when the commands were issued.
0
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
wbstechCommented:
Didn't fully grasp what you were asking there. Yeh ygoutham is right; the logs aren't going to record everything. Just authentication and errors really.
0
 
the_omnificAuthor Commented:
this is my syslog.conf.......

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                          /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none            /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                    /var/log/secure

# Log all the mail messages in one place.
mail.*                                          -/var/log/maillog


# Log cron stuff
cron.*                                          /var/log/cron

# Everybody gets emergency messages
*.emerg                                          *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                    /var/log/spooler

# Save boot messages also to boot.log
local7.*                                    /var/log/boot.log
0
 
the_omnificAuthor Commented:
i just thought it might have been interesting to view the logon attempts....i dont necessarily require the need to know every command a user performs once they have access. It would just be nice to know what was going on etc.
0
 
wbstechCommented:
Try running:

cat /var/log/secure

I think they should already be in there.
0
 
the_omnificAuthor Commented:
Thanks, there seems to be all sorts of logon information in there including ftp etc. Is there any way of creating a separate log file solely for SSH?
0
 
ygouthamCommented:
you can try

cat /var/log/secure | grep sshd

which should filter only sshd related info. but again you have only ipaddresses and times, with some stuff on public key acceptance and other things. it also have the user name between ACCEPTED PASSWORD FOR XXXXXX from x.y.z.a

look through that and the history should give some specific idea
0
 
wbstechCommented:
Try adding the below to the end of the syslog.conf:

#Save only auth info to authinfo.log

authpriv.info                                          /var/log/authinfo.log


Or, you could do the above suggestion and just put "cat /var/log/secure | grep sshd" in a file as below:

echo "cat /var/log/secure | grep sshd" > /usr/bin/showsshdlogs

Then you have in a sense made your own command to show what you need. You can just type "showsshdlogs" at the command prompt and see it all.
0
 
the_omnificAuthor Commented:
Thank you very much. Both of you have been very informative!
0
 
wbstechCommented:
No problem :-)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 5
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now