I want to monitor ssh logins into a Linux box: who, from where (IP address) and when. How to open related logs? A simple document is appreciated.
Please, give more information on what SSH server you use (OpenSSH, dropbear, etc.). I'm using OpenSSH-6.6. It's configuration file is normally found in "/etc/ssh/sshd_config", although you can specify your own configuration file to the server as an argument to the "-f" option (for example, "sshd -f /my/config/file"). The config file has two options which will be of your interest:
"SyslogFacility", according to the docs:
Gives the facility code that is used when logging messages from sshd(8)
"LogLevel", according to the docs:
Gives the verbosity level that is used when logging messages from sshd(8)
My settings in "/etc/ssh/sshd_config":
SyslogFacility AUTH LogLevel INFO
You might also want to have installed some logging daemon like rsyslog or metalog to take care of where all the logging goes. I have installed "rsyslog" and it is configured to drop all logging of facility "AUTH" to "/var/log/auth.log", where I can find lines like these:
May 28 20:54:33 MY-HOSTNAME-HERE sshd: Accepted password for myuser from 127.0.0.1 port 50984 ssh2 May 28 20:54:34 MY-HOSTNAME-HERE sshd: pam_unix(sshd:session): session opened for user myuser by (uid=0) May 28 20:55:12 MY-HOSTNAME-HERE sshd: Received disconnect from 127.0.0.1: 11: disconnected by user May 28 20:55:12 MY-HOSTNAME-HERE sshd: pam_unix(sshd:session): session closed for user myuser
Which is, I think, what you are looking for. The specific config that makes rsyslog to put in that file sshd's logging is:
To install these pieces of software in Debian derivatives:
$ sudo apt-get install rsyslog openssh-server
- SSHD_CONFIG(5): OpenSSH server's configuration file.
- SSHD(8): OpenSSH server's command line manual.
- SYSLOG(3): Linux Programmer's Manual describing facilities and logging levels.
- RSYSLOG.CONF(5): rsyslog daemon's configuration file.
- RSYSLOGD(8): rsyslog daemon's command line manual.
You can find most of what you're looking for in /var/log/messages , which is where Linux usually puts logs. I usually run the following three searches with root privilege to get a good picture
grep -ir ssh /var/log/* grep -ir breakin /var/log/* grep -ir security /var/log/*