3

Short one that I've been unable to find a decent answer for.

Centos 5.10 server, trying to trawl through all the logs I can to see what IPs successfully accessed the server. I've been mucking about with /var/log/secure and /var/log/audit/audit.log.

Most interesting thing I found was from the /root/.bash_history, grepping through a few suspect directories and files for a specific IP but I want to be sure exactly what IPs have accessed the server via ssh.

TL;DR:

Does /var/log/secure log ssh successes or is there some other file on centos systems that do?

  • 4
    welcome to Stack Exchange! on Stack Exchange, we expect people to do a basic level of research before they come to us, given that we're all volunteers. so with that in mind: try it. access the server yourself and see if your IP gets logged. – strugee Apr 11 '14 at 6:43
  • It's just the 'success' but at the end I'm not sure about and was hence wondering if either of them log successful ssh connections (or aren't in this case because of config?) – Nom Apr 11 '14 at 23:04
2

You're looking to grep for "Accepted", not something in the lines of "Success-"

grep Accepted /var/log/secure
1

Since logging is configurable, you will need to check your syslog configuration to figure out exactly what gets logged to where.

  • Any ideas where exactly to check or what to configure? – Nom Apr 11 '14 at 22:58
  • That depends on what syslog program you're using. Please don't take this the wrong way, but I strongly advice you to read the documentation at centos.org/docs/5/html/5.2/Deployment_Guide - there's a section specifically about locating log files, and you really need to know the basics about how the system works. – Jenny D Apr 12 '14 at 19:19
0

/var/log/auth.log logs successful and failed connection attempts. You should check that file.

  • 2
    There is no /var/log/auth on redhat/centos systems. – Nom Apr 11 '14 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.