I have tried a few tutorials on this, but cant seem to get it to work. I would like to log user activity (change dir, upload/download file etc) for chroot users who are in a chroot jail.
My current sshd_config file entry:
Subsystem sftp internal-sftp -l VERBOSE -f LOCAL6 Match Group sftponly ChrootDirectory %h AllowTcpForwarding no X11Forwarding no ForceCommand internal-sftp -l VERBOSE -f LOCAL6
And my current /etc/rsyslog.conf entry (in the RULES section):
$AddUnixListenSocket /user1HomeDir/dev/log local6.* /var/log/sftp.log :programname, isequal, "internal-sftp" -/var/log/sftp.log :programname, isequal, "internal-sftp" ~
I have also created a /dev directory in the users home directory (same dir as their chroot dir)
I still cannot get any logs for these chrooted users. Also, these users have there shell set to /sbin/noshell (not sure if that effects this at all).
I was able to get the logging working by having my sshd_config entry as:
Subsystem sftp internal-sftp -l INFO Match Group sftponly ChrootDirectory h% AllowTcpForwarding no ForceCommand internal-sftp -l INFO X11Forwarding no
Creating a dev folder in the chroot users home directory, And then creating a rsyslog config file /etc/rsyslog.d/sftplogging.conf with the entry:
#create socket in chroot user's dev floder $AddUnixListenSocket /data/sftp/User/home/dev/log #log internal-sftp in a seperate file :programname, isequal, "internal-sftp" -/var/log/sftp.log :programname, isequal, "internal-sftp" ~
This allows me to get logs to /var/log/sftp.log, however because of the limitations of rsyslog being limited to 50 sockets, I instead attempted to change /etc/rsyslog.d/sftplogging.conf to:
and then hardlink it into the users dev folder
ln /data/sftp/syslog.sock dev/log
After restarting rsyslog, this doenst produce any entries in sftp.log