3
votes
1answer
145 views

How to know which public key was used when someone used passwordless ssh login?

Say for some reason, there is only a "user" account on a shhd server. Everyone has his own private key to ssh to the server, as "user". Then, is there a way to see who is he (during or after his ...
0
votes
1answer
150 views

Separate SSHD Authpriv logs into /var/log/sshd, all other authpriv logging goes to messages

Right now, sshd is using the authpriv facility. The level of logging is fine, but I don't want it in the syslog, I want it to go to /var/log/sshd (which doesn't yet exist) on Red Hat Linux/Enterprise ...
1
vote
1answer
1k views

Activity Logging Level in SFTP

I'm using CentOS, i have already figured out how to enable the SFTP Logging. After that when i test it by using FileZilla (from User-end) and tail -f /var/log/sftp.log from the Server, all the ...
1
vote
3answers
7k views

Where are my sshd logs?

I can't find my sshd logs in the standard places. What I've tried: Not in /var/log/auth.log Not in /var/log/secure Did a system search for 'auth.log' and found nothing I've set /etc/ssh/sshd_config ...
2
votes
1answer
90 views

Assuming sshd allows only public key authentication, how do I log the fingerprints?

With OpenSSH, how can I log the fingerprints of the keys used for authentication? I would like to log it in production, so it would be best if this wasn't just some debug setting or similar.
3
votes
2answers
540 views

Is there an easy way to not log a specific sshd event?

The monitoring tool of my hoster is making regular connections with ssh on port 22 to see or the service is up. This is cluttering my /var/log/messages with this kind of messages: Dec 13 22:20:17 ...