5

This may be impossible, but I've got a case where we want to log SSH authentication failures separately from standard SSH logging on a RHEL 6.6 box.

I am aware we can use SyslogFacility with sshd_config to specify where to send log data, is it possible to send only SSH authentication failures via that method?

Edit: If not in sshd or sshd_config, how can this be done on the syslog side?

4
  • 1
    No time to look up that, what I can tell you for sure is that even if you cannot do that on sshd side, you have got filtering in the syslog server side that allow you to do pretty much anything you want, including searching words. You simply define a new log file, with a matching source+filter. Nov 25, 2015 at 16:00
  • 1
    @RuiFRibeiro thanks for the hint, but lets assume for a moment I'm a newbie when it comes to handling this in syslog... Nov 25, 2015 at 16:05
  • 1
    (I hinted in the last message I have not got time right now. Will answer later on if in the meanwhile you have not got a solution) Nov 25, 2015 at 16:08
  • 1
    (@RuiFRibeiro OK, didn't mean to say ou had to answer now :P I also added an edit to the question in case someone else beats you to it :) ) Nov 25, 2015 at 16:09

2 Answers 2

4
+50

rsyslog makes this relatively easy, since you can match aspects of whatever message arrives.

Include a snippet like this (in my case I put a *.conf file into /etc/rsyslog.d/):

if $programname == 'sshd' then {
    if $msg contains 'Invalid user' then { # adjust to your needs
        *.* -/var/log/sshd-fails.log
    }
    stop # discard all other messages from sshd
}

Documentation can be found here.

3

Syslog is definitely the way to go on this one. How you write the rules depends on whether you're using rsyslog or syslog-ng but for syslog-ng add the following to the /etc/syslog-ng/syslog-ng.conf file.

destination ssh_auth_fail { file("/path/to/file.log"); };
filter f_ssh_auth_fail { message("regex to match desired lines"); };
log { source(src); filter(f_ssh_auth_fail); destination(ssh_auth_fail); };
2
  • 1
    Any chance you have an rsyslogd approach? Since that's what's on the systems right now... Dec 3, 2015 at 21:19
  • 2
    @ThomasW.: see my answer regarding rsyslog. Dec 4, 2015 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .