0

I want to monitor ssh logins into a Linux box: who, from where (IP address) and when. How to open related logs? A simple document is appreciated.

  • The location of log files depend on the distribution. What distribution are you using? – Gilles May 29 '15 at 21:08
1

Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which will be of your interest:

  • "SyslogFacility", according to the docs:

    Gives the facility code that is used when logging messages from sshd(8)

  • "LogLevel", according to the docs:

    Gives the verbosity level that is used when logging messages from sshd(8)

My settings in "/etc/ssh/sshd_config":

SyslogFacility AUTH
LogLevel INFO

You might also want to have installed some logging daemon like rsyslog or metalog to take care of where all the logging goes. I have installed "rsyslog" and it is configured to drop all logging of facility "AUTH" to "/var/log/auth.log", where I can find lines like these:

May 28 20:54:33 MY-HOSTNAME-HERE sshd[2025]: Accepted password for myuser from 127.0.0.1 port 50984 ssh2
May 28 20:54:34 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2107]: Received disconnect from 127.0.0.1: 11: disconnected by user
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session closed for user myuser

Which is, I think, what you are looking for. The specific config that makes rsyslog to put in that file sshd's logging is:

auth,authpriv.*                 /var/log/auth.log

To install these pieces of software in Debian derivatives:

$ sudo apt-get install rsyslog openssh-server

References:

  • SSHD_CONFIG(5): OpenSSH server's configuration file.
  • SSHD(8): OpenSSH server's command line manual.
  • SYSLOG(3): Linux Programmer's Manual describing facilities and logging levels.
  • RSYSLOG.CONF(5): rsyslog daemon's configuration file.
  • RSYSLOGD(8): rsyslog daemon's command line manual.
  • Thanks user2512368, I just use default SSH server from CentOS, a quite dumb question, how to check which SSH server I am using. :) – Lin Ma Jun 3 '15 at 21:31
  • @LinMa, you are most likely using OpenSSH's server. To check what version of OpenSSH-server you have installed run this command: yum info openssh-server. In the (utterly) strange case that you wouldn't have it installed and you decide that that's the SSH server you want to use, install it by running: yum install openssh-server (as "root", or as a regular user with "sudo"). To check if it's running run netstat -tulnpv | grep ssh as "root" and see where it is listening. To manually start the server run /sbin/service sshd start as "root". – Diego Augusto Molina Jun 4 '15 at 0:06
1

You can find most of what you're looking for in /var/log/messages , which is where Linux usually puts logs. I usually run the following three searches with root privilege to get a good picture

grep -ir ssh /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*
  • Assuming you aren't blessed with systemd. :) – lcd047 May 29 '15 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.