1

I want to know who is accessing my server at any point in time and see logs from the past, however it is behind an SSH tunnel. How can I do this?

EDIT: See tags, running debian on both machines. SSHD is my SSH server.

EDIT: I already know how to List all connected SSH sessions? but I don't know which if any apply to ssh tunnels. They all seem to refer to PTS or TTY and I don't think SSH tunnels are like that although I may be wrong.

2

All the information you are looking for is available from the standard security logging/journaling service, which is included with systemd services.

Look into /var/log/auth.log in Debian installation or /var/log/secure in Red-Hat installation , if its is not there you might wish to install and activate the journaling service.

Learn to dig into the journal with journalctl command.

Learn more about journald service.

Good luck with your dig.

| improve this answer | |
  • Thank you for the answer! /var/log/secure indeed does not exist however I shall do some research when I can. – Jachdich May 31 '19 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.