I have a network device (a scanner) that can scan to SFTP. Unfortunately, it's giving me problems. I can see from the SSH logs that it's able to login, but I can't see what it's doing after that. I think it's running into a file or directory not found situation. The device has no verbose logging capability. So I have to do this on the server somehow.

How can I monitor/log what happens after it has successfully establish an SSH connection?

  • What is this device? Does it have shell access, can you run strace and restart the SSH daemon? Can you not run sshd more verbosely and/or run it in the foreground? – slm Sep 1 '18 at 21:53
  • I see why the confusion. I amended the question. It's a scanner. It uses SFTP. I can run strace and restart the ssh daemon. I'll see what it does. – 010110110101 Sep 1 '18 at 22:10
  • I just did a bit ago. – slm Sep 2 '18 at 3:38

Per this solution from the RHEL forums titled: How to configure SSH to debug mode?

Method #1 - sshd on another port

$ /usr/sbin/sshd -ddd -D -p (port) 2>&1

Then to connect to it:

$ ssh -p (port)

Method #2 - change sshd's config file

$ vim /etc/ssh/sshd_config

Then change the loglevel:

LogLevel DEBUG3

And then restart sshd.

$ service sshd restart

sshd_config man page

$ man sshd_config

Gives the verbosity level that is used when logging messages from sshd.  
The possible values are: QUIET, FATAL, ERROR, INFO, VER-BOSE, DEBUG, DEBUG1, 
DEBUG2 and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 
and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG 
level violates the privacy of users and is not recommended.

The best solution would be to enable TTY logging so it shows up in audit logs

echo "session     required      pam_tty_audit.so enable=*" >> /etc/pam.d/password-auth-ac
echo "session     required      pam_tty_audit.so enable=*" >> /etc/pam.d/system-auth-ac

Then, to view the logs you can use:

aureport --tty

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.