0

So I'm having the issue where I can't seem to log users SFTP activity. I can see when a new session was created by a specific user, but can't see where they've been or what they may have dropped within the directory.

My SFTP users are all chrooted in the same place (/data/SFTP/) - each one does not have a specific folder.

My directory looks like this:

/data/SFTP/SFTPHome

Every SFTP user has access to the /SFTPHome directory, but not its parent directories.


/etc/ssh/sshd_config:

Subsystem sftp internal-sftp -f AUTH -l VERBOSE

Match Group SFTPUsers
        PasswordAuthentication no
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory /data/SFTP/
        ForceCommand internal-sftp -f AUTH -l VERBOSE

/etc/rsyslog.conf:

# Logs all SFTP activity
auth.*                                                  /var/log/sftp.log

With this in place, the only information that fills the /var/log/sftp.log is

Feb 13 16:05:59 Host_SFTP systemd-logind: New session 30 of user JOHNSON.
Feb 13 16:06:30 Host_SFTP systemd-logind: Removed session 30.
Feb 13 16:09:17 Host_SFTP sshd[7126]: rexec line 63: Deprecated option RhostsRSAAuthentication
Feb 13 16:09:32 Host_SFTP systemd-logind: New session 31 of user JOHNSON.
Feb 13 16:09:32 Host_SFTP systemd-logind: Removed session 31.
Feb 13 16:14:17 Host_SFTP sshd[7154]: rexec line 63: Deprecated option RhostsRSAAuthentication
Feb 13 16:14:24 Host_SFTP sshd[7156]: rexec line 63: Deprecated option RhostsRSAAuthentication
Feb 13 16:14:32 Host_SFTP systemd-logind: New session 32 of user JOHNSON.
Feb 13 16:14:57 Host_SFTP systemd-logind: Removed session 32.

How can I set this up so I can monitor where and what files are being placed within the SFTP directory?

  • Try log level DEBUG3 instead of VERBOSE. If you still aren't getting anything, there may be a problem logging from inside the chroot jail. – Kenster Feb 14 at 0:14
  • Just tried that - no changes. I have a feeling that the issue has to do with its logging inside the chroot jail, but at that point I'm a bit lost and not sure what I should do.. – veanome Feb 14 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.