1

This article (Setting up logging for chroot users) is the only one that has helped me to get logging working for chroot'd sftp users, so huge thanks for that!

However, for some reason, my logs messages are all going to /var/log/secure and not to /var/log/sftp.log even though my /etc/rsyslog.d/sftplogging.conf file looks like this:

#create socket in chroot user's dev floder
$AddUnixListenSocket /sftproot/files/customer/live/customerlive/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/customertest/dev/log
$AddUnixListenSocket /sftproot/files/customer/live/dev/log
$AddUnixListenSocket /sftproot/files/customer/test/dev/log

#log internal-sftp in a seperate file
:programname, isequal, "internal-sftp" -/var/log/sftp.log
:programname, isequal, "internal-sftp" ~

Does anyone have any ideas why this isn't logging to /var/log/sftp.log please?

2
  • did you create socket ? what is result from file /sftproot/files/customer/test/dev/log ?
    – Archemar
    Jul 11, 2018 at 8:47
  • Thanks for replying. The result is: /sftproot/files/customer/test/dev/log: socket
    – Bryn Ellis
    Jul 16, 2018 at 14:54

1 Answer 1

1

My configuration is a bit different, in my /etc/ssh/sshd_conf I specify a local where to send the logs:

Subsystem sftp internal-sftp -f LOCAL4 -l VERBOSE

Then I refer that local in my rsyslog.conf with

local4.* -/var/log/sshd.log

That will log my user's acctions in /var/log/sshd.log.

4
  • Thanks for replying. Is your user chrooted? I've always been a bit confused with the whole LOCAL3,4,5,6... thing to be honest! I don't actually know what LOCAL4 is or means which is why I steered away from that solution.
    – Bryn Ellis
    Jul 16, 2018 at 14:56
  • Yes they are, I have plenty of them. If I'm not mistaken you can choose a local number which is not being used for logging anything else and take it for your logs. In my case it was 4.
    – YoMismo
    Jul 16, 2018 at 15:02
  • How to know which local number which is not being used ? me facing issue in SFTP activity logging hope this could shed some light on my work.
    – BalaB
    Apr 15, 2020 at 3:16
  • @BalaB check your syslog configuration file, in it you specify in which files you store your log messages, check if any local is being used and choose a number not in use there and create an entry for your ssh logs, then configure your sshd_config to send logs to that local.
    – YoMismo
    Apr 16, 2020 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .