| View previous topic :: View next topic |
| Author |
Message |
sjcarr
n00b
Joined: 06 Jun 2005
Posts: 47
|
 Posted: Sat Jan 05, 2008 1:05 pm Post subject: SFTP Access Logging |
 |
|
Just a quick one really, does anyone know how you can make SFTP log abit more detail about who is connecting from where etc.
At the moment the logs show:
| Code: | Jan 5 13:01:14 src@host sshd[18518]: Accepted password for root from 172.16.0.42 port 52065 ssh2
Jan 5 13:01:14 src@host sshd[18518]: subsystem request for sftp
Jan 5 13:01:16 src@host sshd[18518]: Received disconnect from 172.16.0.42: 11: Closed due to user request.
Jan 5 13:01:18 src@host sshd[18521]: Accepted publickey for sjcarr from 172.16.0.42 port 52066 ssh2
Jan 5 13:01:18 src@host sshd[18523]: subsystem request for sftp
Jan 5 13:01:19 src@host sshd[18523]: Received disconnect from 172.16.0.42: 11: Closed due to user request. |
Is is possible for the line which states:
| Code: | | subsystem request for sftp |
To instead say something like:
| Code: | | subsystem request for sftp for user@host/ip using software XYZ |
Any thoughts? |
|
| Back to top |
|
 |
Dagger
Retired Dev
Joined: 11 Jun 2003
Posts: 765
Location: UK
|
| Posted: Sat Jan 05, 2008 2:30 pm Post subject: |
|
|
unless you want to hack SSH by yourself I I wouldn't expect that. You've got information about the user and his source IP in the line above.
You can make yourself a simple log parser which would read your logs and create an output you want with USER@IP, but thats it.
_________________
95% of all computer errors occur between chair and keyboard (TM)
Join the FSF as an Associate Member!
Post under CC license. |
|
| Back to top |
|
|
D-Code
n00b
Joined: 03 Feb 2006
Posts: 3
Location: Stockholm
|
| Posted: Mon Jan 07, 2008 7:34 pm Post subject: |
|
|
SSHD can only log so much, but it is possible to make sftp-server log session activity.
Open the file /etc/ssh/sshd_config for editing.
Look for the line that says:
| Code: | | Subsystem sftp /usr/lib/misc/sftp-server |
Change that line to say:
| Code: | | Subsystem sftp /usr/lib/misc/sftp-server -l INFO -f USER |
Then reload/restart sshd to apply the changes. |
|
| Back to top |
|
|
|
Networking & Security
