0

I want to monitor ssh logins into a Linux box: who, from where (IP address) and when. How to open related logs? A simple document is appreciated.

1
  • The location of log files depend on the distribution. What distribution are you using? May 29, 2015 at 21:08

2 Answers 2

1

Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which will be of your interest:

  • "SyslogFacility", according to the docs:

    Gives the facility code that is used when logging messages from sshd(8)

  • "LogLevel", according to the docs:

    Gives the verbosity level that is used when logging messages from sshd(8)

My settings in "/etc/ssh/sshd_config":

SyslogFacility AUTH
LogLevel INFO

You might also want to have installed some logging daemon like rsyslog or metalog to take care of where all the logging goes. I have installed "rsyslog" and it is configured to drop all logging of facility "AUTH" to "/var/log/auth.log", where I can find lines like these:

May 28 20:54:33 MY-HOSTNAME-HERE sshd[2025]: Accepted password for myuser from 127.0.0.1 port 50984 ssh2
May 28 20:54:34 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session opened for user myuser by (uid=0)
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2107]: Received disconnect from 127.0.0.1: 11: disconnected by user
May 28 20:55:12 MY-HOSTNAME-HERE sshd[2025]: pam_unix(sshd:session): session closed for user myuser

Which is, I think, what you are looking for. The specific config that makes rsyslog to put in that file sshd's logging is:

auth,authpriv.*                 /var/log/auth.log

To install these pieces of software in Debian derivatives:

$ sudo apt-get install rsyslog openssh-server

References:

  • SSHD_CONFIG(5): OpenSSH server's configuration file.
  • SSHD(8): OpenSSH server's command line manual.
  • SYSLOG(3): Linux Programmer's Manual describing facilities and logging levels.
  • RSYSLOG.CONF(5): rsyslog daemon's configuration file.
  • RSYSLOGD(8): rsyslog daemon's command line manual.
2
  • Thanks user2512368, I just use default SSH server from CentOS, a quite dumb question, how to check which SSH server I am using. :)
    – Lin Ma
    Jun 3, 2015 at 21:31
  • @LinMa, you are most likely using OpenSSH's server. To check what version of OpenSSH-server you have installed run this command: yum info openssh-server. In the (utterly) strange case that you wouldn't have it installed and you decide that that's the SSH server you want to use, install it by running: yum install openssh-server (as "root", or as a regular user with "sudo"). To check if it's running run netstat -tulnpv | grep ssh as "root" and see where it is listening. To manually start the server run /sbin/service sshd start as "root". Jun 4, 2015 at 0:06
1

You can find most of what you're looking for in /var/log/messages , which is where Linux usually puts logs. I usually run the following three searches with root privilege to get a good picture

grep -ir ssh /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*
1
  • Assuming you aren't blessed with systemd. :)
    – lcd047
    May 29, 2015 at 4:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .