Solved

How to enable SFTP logging in AIX?

Posted on 2009-04-15
8
7,634 Views
Last Modified: 2013-11-17
I need to be able to log sftp commands with the same level of verbosity I log ftp commands. That is, what file a user if ftp'ng, did they delete and files during their sftp session, and so on. Any help would be appreciated, thanks!

File levels below:
  openssh.base.client     5.0.0.5301  COMMITTED  Open Secure Shell Commands
  openssh.base.client     5.0.0.5301  COMMITTED  Open Secure Shell Commands
  openssh.base.server     5.0.0.5301  COMMITTED  Open Secure Shell Server
  openssh.base.server     5.0.0.5301  COMMITTED  Open Secure Shell Server
  openssh.license         5.0.0.5301  COMMITTED  Open Secure Shell License
  openssh.man.en_US       5.0.0.5301  COMMITTED  Open Secure Shell
  openssl.base             0.9.8.802  COMMITTED  Open Secure Socket Layer
  openssl.base             0.9.8.802  COMMITTED  Open Secure Socket Layer
  openssl.license          0.9.8.802  COMMITTED  Open Secure Socket License
  openssl.man.en_US        0.9.8.802  COMMITTED  Open Secure Socket Layer

0
Comment
Question by:shanetexas
  • 4
  • 4
8 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 24150293
Hi,

in /etc/ssh/sshd_config uncomment the 'Subsystem' line, and
change '/usr/sbin/sftp-server' to '/usr/sbin/sftp-server -l [loglevel] -f [log-facility]'
where [loglevel] is the setting you made in sshd_config for LogLevel (default: INFO)
and [log-facility] is the setting you made in sshd_config for SyslogFacility (default: AUTH). e.g.

Subsystem sftp /usr/sbin/sftp-server -l info -f auth

Next, edit /etc/syslog.conf (if you didn't do that already) and add a line

auth.info      /path/to/logfile

e.g.

auth.info /var/log/auth.log

Now issue 'touch /path/to/logfile', e.g. 'touch /var/log/auth.log' and

restart sshd and syslogd by issuing
refresh -s syslogd
and
stopsrc  -s sshd ; startsrc -s sshd

Take care that /usr/sbin/sftp-server is executable (I saw systems where it wasn't by default) by issuing

chmod +x /usr/sbin/sftp-server

Now you should see entries arriving in your logfile.

Cheers

wmp




0
 

Author Comment

by:shanetexas
ID: 24151046
I did everything you said but now I cant connect via sftp.

I get SFTP Connection Error.

When I remove the additional -f INFO -l AUTH from the

Subsystem       sftp    /usr/sbin/sftp-server

entry in /etc/ssh/sshd_config it connects?

Shane
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 24151487
Well,

it's -l INFO -f AUTH
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:shanetexas
ID: 24151717
Ok, I've got it logging but the detail is nothing more than showing I logged in:

Apr 15 13:44:08 tech9 auth|security:info sshd[380998]: Accepted password for root from 10.150.71.15 port 2732 ssh2
Apr 15 13:44:08 tech9 auth|security:info sshd[380998]: subsystem request for sftp

Is there a way I can capture the names of the files the users are sftp'ng?

Shane
0
 
LVL 68

Accepted Solution

by:
woolmilkporc earned 500 total points
ID: 24151879
With auth.info it should do what you want!

This is a part of my log:

Apr 15 19:13:58 lpxxxx auth|security:info sshd[409830]: Accepted publickey for root from 172.16.xx.xxx port 52556 ssh2
Apr 15 19:13:58 lpxxxx auth|security:info sshd[409830]: subsystem request for sftp
Apr 15 19:13:58 lpxxxx auth|security:info sftp-server[364600]: session opened for local user root from [172.16.xx.xxx]
Apr 15 19:14:05 lpxxxx auth|security:info sftp-server[364600]: open "/home/admin/root/testfile" flags WRITE,CREATE,TRUNCATE mode 0644
Apr 15 19:14:05 lpxxxx auth|security:info sftp-server[364600]: close "/home/admin/root/testfile" bytes read 8160 written 8160
Apr 15 19:14:33 lpxxxx auth|security:info sftp-server[364600]: session closed for local user root from [172.16.xx.xxx]

sshd_config:
#SyslogFacility AUTH (# = left on default)
#LogLevel INFO           (# = left on default)
Subsystem       sftp    /usr/sbin/sftp-server -l INFO -f AUTH

syslog.conf:
auth.info               /var/log/auth.log

/var/log:
-rw-r--r--    1 root     system        982244 Apr 15 19:14 /var/log/auth.log


Do you have the correct line in syslog.conf? Seems that you're only logging sshd!

auth.info in syslogd.conf must correspond to -l INFO -f AUTH  (uppercase or lowercase doesn't matter!)

Did you look at the right logfile? Did you 'touch' it if it did not already exist?
0
 

Author Comment

by:shanetexas
ID: 24152003
/etc/ssh/sshd_config
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
&
# override default of no subsystems
Subsystem       sftp    /usr/sbin/sftp-server -l INFO -f AUTH

/etc/syslog.conf    
auth.info               /var/log/auth.log

ls -l /var/log/auth.log
-rw-rw-rw-    1 root     system            0 Apr 15 14:53 /var/log/auth.log

#refresh -s syslogd
0513-095 The request for subsystem refresh was completed successfully.
#stopsrc -s sshd ; sleep 5 ; startsrc -s sshd ; lssrc -g ssh
0513-044 The sshd Subsystem was requested to stop.
0513-059 The sshd Subsystem has been started. Subsystem PID is 377040.
Subsystem         Group            PID          Status
 sshd             ssh              377040       active

For some reason it works now!!!

Apr 15 15:00:54 tech9 auth|security:info sshd[385140]: Accepted password for root from 10.150.71.15 port 2947 ssh2
Apr 15 15:00:54 tech9 auth|security:info sshd[385140]: subsystem request for sftp
Apr 15 15:00:54 tech9 auth|security:info sftp-server[372900]: session opened for local user root from [10.150.71.15]
Apr 15 15:00:54 tech9 auth|security:info sftp-server[372900]: opendir "/home/root"
Apr 15 15:00:54 tech9 auth|security:info sftp-server[372900]: closedir "/home/root"
Apr 15 15:01:17 tech9 auth|security:info sftp-server[372900]: sent status No such file
Apr 15 15:01:17 tech9 auth|security:info sftp-server[372900]: sent status No such file
Apr 15 15:01:17 tech9 auth|security:info sftp-server[372900]: open "/home/root/shane.txt" flags WRITE,CREATE,TRUNCATE mode 0666
Apr 15 15:01:17 tech9 auth|security:info sftp-server[372900]: close "/home/root/shane.txt" bytes read 0 written 179
Apr 15 15:01:17 tech9 auth|security:info sftp-server[372900]: set "/home/root/shane.txt" modtime 20090414-10:57:24
Apr 15 15:01:29 tech9 auth|security:info sftp-server[372900]: rename old "/home/root/shane.txt" new "/home/root/asdfshane.txt"
Apr 15 15:01:38 tech9 auth|security:info sftp-server[372900]: remove name "/home/root/asdfshane.txt"
Apr 15 15:01:38 tech9 auth|security:info sftp-server[372900]: opendir "/home/root/"
Apr 15 15:01:39 tech9 auth|security:info sftp-server[372900]: closedir "/home/root/"
Apr 15 15:01:47 tech9 auth|security:info sftp-server[372900]: session closed for local user root from [10.150.71.15]

Thank you very much!!!

Shane
0
 

Author Closing Comment

by:shanetexas
ID: 31570559
Thank you for your time and help!
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 24152059
You're very welcome! Thx for the points. I think the clue was the refresh of syslogd!
Cheers and good luck,

Wmp
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Attention: This article will no longer be maintained. If you have any questions, please feel free to mail me. jgh@FreeBSD.org Please see http://www.freebsd.org/doc/en_US.ISO8859-1/articles/freebsd-update-server/ for the updated article. It is avail…
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap (http://www.tcpdump.org) Version 1.2 2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6 Prerequisite: 1.      GCC …
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question