Howto log multiple sftpd server's activity which user's chrooted home is on shared NFS?

Question

I have an Ubuntu server with sftpd running where /var/data/chroot/ is an NFS mount from a remote central NFS server, and each sftpd user's chroot home is /var/data/chroot/<username>/ and every user has a log device /var/data/chroot/<username>/dev/log which I read in successfully with syslog-ng:

source s_chroot_<username>    { unix-stream("/var/data/chroot/<username>/dev/log" optional(yes) ); };
destination d_sftp_<username> { file("/var/log/sftp/<username>.log"); };

Now I have a second sftpd server in parallel, with the same user database and also mounts /var/data/chroot/ via NFS, and has the same syslog-ng config, so every user can login on the one server or on the other. This is for high availability. This works so far.

What is not working now is the sftpd logging: The sftp user's log is only available on one sftp server exclusively, and that is the one where syslog-ng was started least, because as I understand it takes the exclusive unix socket file lock for each user's /dev/log.

So, if a user logs in on the first server, where syslog-ng was started least, the user's sftp activity is logged on the first server. But if the user logs in on the second server, it's sftp activity is not logged, neither on the second nor on the first server.

If the syslog-ng is then restarted on the second server, the sftp user's activity is exclusively logged only on the second server and only for logins on the second server.

How can I get the sftp user's activity be logged on each sftp server, when a user logs in to that server, while the user's home is shared on both servers via NFS?

Answer 1

My workaround is the following:

Create a local directory under which user subdirectories are created: sudo mkdir /var/data/dev For very username <username> and the user's primary group <groupname> do the following:

sudo mkdir             /var/data/dev/<username>
sudo chmod 550         /var/data/dev/<username>       # This restrictive permission is a requirement I think
sudo chgrp <groupname> /var/data/dev/<username>       # so the user can read the directory

So the new directory is exactly the same as the existing /var/data/chroot/<username>/dev directory (which is on the nfs mount /var/data/chroot/).

Then do mount --bind /var/data/dev/<username> /var/data/chroot/<username>/dev so /var/data/chroot/<username>/dev is now effectively local on the sftp server, not anymore on nfs mount.

Then change the syslog-ng config

from

source s_chroot_<username> { unix-stream("/var/data/chroot/<username>/dev/log" optional(yes) ); };

to

source s_chroot_<username> { unix-stream("/var/data/dev/<username>/log" optional(yes) ); };

(this is not strictly needed, but I think it's nice having syslog-ng definitely now only reading from local file, guaranteed not from nfs mount anymore)

Whether the user logs in on the one sftp server or the other, syslog-ng can now log the sftp session on the affected sftp server.

While it is still a mess to have multiple (in my case several hundrets) bind mounts which I very much would like to avoid, I think this workaround is acceptable because the impact is limited to the logging functionality and not the sftp service itself. Speaking, if there are problems with the bind mounts, the impact is only that there is no sftp session logging. Also, this is very simple, uniform and clear.