Linux ssh log audit

Question

I want to monitor ssh logins into a Linux box: who, from where (IP address) and when. How to open related logs? A simple document is appreciated.

Answer 1

Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which will be of your interest:

• "SyslogFacility", according to the docs:

  Gives the facility code that is used when logging messages from sshd(8)

• "LogLevel", according to the docs:

  Gives the verbosity level that is used when logging messages from sshd(8)

My settings in "/etc/ssh/sshd_config":

SyslogFacility AUTH
LogLevel INFO

You might also want to have installed some logging daemon like rsyslog or metalog to take care of where all the logging goes. I have installed "rsyslog" and it is configured to drop all logging of facility "AUTH" to "/var/log/auth.log", where I can find lines like these:

May 28 20:54:33 MY-HOSTNAME-HERE sshd[2025]: Accepted password for myuser from 127.0.0.1 port 50984 ssh2
May 28 20:54:34 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2107]: Received disconnect from 127.0.0.1: 11: disconnected by user
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session closed for user myuser

Which is, I think, what you are looking for. The specific config that makes rsyslog to put in that file sshd's logging is:

auth,authpriv.*                 /var/log/auth.log

To install these pieces of software in Debian derivatives:

$ sudo apt-get install rsyslog openssh-server

References:

• SSHD_CONFIG(5): OpenSSH server's configuration file.
• SSHD(8): OpenSSH server's command line manual.
• SYSLOG(3): Linux Programmer's Manual describing facilities and logging levels.
• RSYSLOG.CONF(5): rsyslog daemon's configuration file.
• RSYSLOGD(8): rsyslog daemon's command line manual.

Answer 2

You can find most of what you're looking for in /var/log/messages , which is where Linux usually puts logs. I usually run the following three searches with root privilege to get a good picture

grep -ir ssh /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*