My server is Centos 5. I have a chroot environment set up with the following in my sshd_config
Match group sftponly ForceCommand internal-sftp ChrootDirectory %h AllowTcpForwarding no PasswordAuthentication yes Match
When a user connects by sftp, a line is added to /var/log/secure:
Sep 3 15:30:20 servername sshd: pam_unix(sshd:session): session opened for user test by (uid=0)
However they are not present when executing
[root@servername home]# w 15:30:47 up 156 days, 1:00, 3 users, load average: 0.05, 0.18, 0.32 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT mike pts/1 22.214.171.124 Fri16 0.00s 0.10s 0.03s sshd: mike [priv]
But when users connect by SSH (like the user above), they are present. Is this standard behavior?