2

I want to know who is accessing my server at any point in time and see logs from the past, however it is behind an SSH tunnel. How can I do this?

EDIT: See tags, running debian on both machines. SSHD is my SSH server.

EDIT: I already know how to List all connected SSH sessions? but I don't know which if any apply to ssh tunnels. They all seem to refer to PTS or TTY and I don't think SSH tunnels are like that although I may be wrong.

Improve this question

1 Answer 1

Reset to default
4

All the information you are looking for is available from the standard security logging/journaling service, which is included with systemd services.

Look into /var/log/auth.log in Debian installation or /var/log/secure in Red-Hat installation , if its is not there you might wish to install and activate the journaling service.

Learn to dig into the journal with journalctl command.

Learn more about journald service.

Good luck with your dig.

Improve this answer
1
  • Thank you for the answer! /var/log/secure indeed does not exist however I shall do some research when I can.
    – Jachdich
    May 31, 2019 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .