I want to monitor ssh logins into a Linux box: who, from where (IP address) and when. How to open related logs? A simple document is appreciated.
2 Answers
Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which will be of your interest:
"SyslogFacility", according to the docs:
Gives the facility code that is used when logging messages from sshd(8)
"LogLevel", according to the docs:
Gives the verbosity level that is used when logging messages from sshd(8)
My settings in "/etc/ssh/sshd_config":
SyslogFacility AUTH
LogLevel INFO
You might also want to have installed some logging daemon like rsyslog or metalog to take care of where all the logging goes. I have installed "rsyslog" and it is configured to drop all logging of facility "AUTH" to "/var/log/auth.log", where I can find lines like these:
May 28 20:54:33 MY-HOSTNAME-HERE sshd[2025]: Accepted password for myuser from 127.0.0.1 port 50984 ssh2
May 28 20:54:34 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2107]: Received disconnect from 127.0.0.1: 11: disconnected by user
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session closed for user myuser
Which is, I think, what you are looking for. The specific config that makes rsyslog to put in that file sshd's logging is:
auth,authpriv.* /var/log/auth.log
To install these pieces of software in Debian derivatives:
$ sudo apt-get install rsyslog openssh-server
References:
- SSHD_CONFIG(5): OpenSSH server's configuration file.
- SSHD(8): OpenSSH server's command line manual.
- SYSLOG(3): Linux Programmer's Manual describing facilities and logging levels.
- RSYSLOG.CONF(5): rsyslog daemon's configuration file.
- RSYSLOGD(8): rsyslog daemon's command line manual.
-
Thanks user2512368, I just use default SSH server from CentOS, a quite dumb question, how to check which SSH server I am using. :)– Lin MaJun 3, 2015 at 21:31
-
@LinMa, you are most likely using OpenSSH's server. To check what version of OpenSSH-server you have installed run this command:
yum info openssh-server
. In the (utterly) strange case that you wouldn't have it installed and you decide that that's the SSH server you want to use, install it by running:yum install openssh-server
(as "root", or as a regular user with "sudo"). To check if it's running runnetstat -tulnpv | grep ssh
as "root" and see where it is listening. To manually start the server run/sbin/service sshd start
as "root". Jun 4, 2015 at 0:06
You can find most of what you're looking for in /var/log/messages , which is where Linux usually puts logs. I usually run the following three searches with root privilege to get a good picture
grep -ir ssh /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*