ssh und sftp logging

S

Serow

0
Hi,

ich möchte das Logging von meinem SSHD gerne so anpassen, dass ich auch mitbekomme wer welches File z.B. per scp zieht. Dazu habe ich meien sshd_config so angepasst:

Code: 
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel DEBUG
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
Banner /etc/issue.net
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTH -l DEBUG
UsePAM yes

Das LogLevel DEBUG kann ich mir wahrscheinlich schenken, aber mit wunderts, dass von sftp-server so garnichts kommt:

Code: 
Sep 11 12:37:28 homesrv sshd[5445]: debug1: Forked child 5481.
Sep 11 12:37:28 homesrv sshd[5481]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Sep 11 12:37:28 homesrv sshd[5481]: debug1: inetd sockets after dupping: 3, 3
Sep 11 12:37:28 homesrv sshd[5481]: Connection from 10.0.0.201 port 33530
Sep 11 12:37:28 homesrv sshd[5481]: debug1: Client protocol version 2.0; client software version OpenSSH_5.1p1 Debian-5
Sep 11 12:37:28 homesrv sshd[5481]: debug1: match: OpenSSH_5.1p1 Debian-5 pat OpenSSH*
Sep 11 12:37:28 homesrv sshd[5481]: debug1: Enabling compatibility mode for protocol 2.0
Sep 11 12:37:28 homesrv sshd[5481]: debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-5
Sep 11 12:37:28 homesrv sshd[5481]: debug1: PAM: initializing for "mathias"
Sep 11 12:37:28 homesrv sshd[5481]: debug1: PAM: setting PAM_RHOST to "10.0.0.201"
Sep 11 12:37:28 homesrv sshd[5481]: debug1: PAM: setting PAM_TTY to "ssh"
Sep 11 12:37:28 homesrv sshd[5481]: Failed none for mathias from 10.0.0.201 port 33530 ssh2
Sep 11 12:37:28 homesrv sshd[5481]: debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
Sep 11 12:37:28 homesrv sshd[5481]: debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
Sep 11 12:37:28 homesrv sshd[5481]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Sep 11 12:37:28 homesrv sshd[5481]: debug1: trying public key file /home/mathias/.ssh/authorized_keys
Sep 11 12:37:28 homesrv sshd[5481]: debug1: fd 4 clearing O_NONBLOCK
Sep 11 12:37:28 homesrv sshd[5481]: Authentication refused: bad ownership or modes for file /home/mathias/.ssh/authorized_keys
Sep 11 12:37:28 homesrv sshd[5481]: debug1: restore_uid: 0/0
Sep 11 12:37:28 homesrv sshd[5481]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Sep 11 12:37:28 homesrv sshd[5481]: debug1: trying public key file /home/mathias/.ssh/authorized_keys2
Sep 11 12:37:28 homesrv sshd[5481]: debug1: restore_uid: 0/0
Sep 11 12:37:28 homesrv sshd[5481]: Failed publickey for mathias from 10.0.0.201 port 33530 ssh2
Sep 11 12:37:30 homesrv sshd[5481]: debug1: PAM: password authentication accepted for mathias
Sep 11 12:37:30 homesrv sshd[5481]: debug1: do_pam_account: called
Sep 11 12:37:30 homesrv sshd[5481]: Accepted password for mathias from 10.0.0.201 port 33530 ssh2
Sep 11 12:37:30 homesrv sshd[5481]: debug1: monitor_child_preauth: mathias has been authenticated by privileged process
Sep 11 12:37:30 homesrv sshd[5481]: debug1: PAM: establishing credentials
Sep 11 12:37:30 homesrv sshd[5481]: pam_unix(sshd:session): session opened for user mathias by (uid=0)
Sep 11 12:37:30 homesrv sshd[5481]: User child is on pid 5484
Sep 11 12:37:30 homesrv sshd[5484]: debug1: SELinux support disabled
Sep 11 12:37:30 homesrv sshd[5484]: debug1: PAM: establishing credentials
Sep 11 12:37:30 homesrv sshd[5484]: debug1: permanently_set_uid: 1000/1000
Sep 11 12:37:30 homesrv sshd[5484]: debug1: Entering interactive session for SSH2.
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_init_dispatch_20
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_input_channel_open: ctype session rchan 0 win 2097152 max 32768
Sep 11 12:37:30 homesrv sshd[5484]: debug1: input_session_request
Sep 11 12:37:30 homesrv sshd[5484]: debug1: channel 0: new [server-session]
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_new: session 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_open: channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_open: session 0: link with channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_input_channel_open: confirm session
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_input_global_request: rtype no-more-sessions@openssh.com want_reply 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_input_channel_req: channel 0 request env reply 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_by_channel: session 0 channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_input_channel_req: session 0 req env
Sep 11 12:37:30 homesrv sshd[5484]: debug1: server_input_channel_req: channel 0 request exec reply 1
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_by_channel: session 0 channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_input_channel_req: session 0 req exec
Sep 11 12:37:30 homesrv sshd[5484]: debug1: Received SIGCHLD.
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_by_pid: pid 5485
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_exit_message: session 0 channel 0 pid 5485
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_exit_message: release channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_by_channel: session 0 channel 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_close_by_channel: channel 0 child 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: session_close: session 0 pid 0
Sep 11 12:37:30 homesrv sshd[5484]: debug1: channel 0: free: server-session, nchannels 1
Sep 11 12:37:30 homesrv sshd[5484]: Connection closed by 10.0.0.201
Sep 11 12:37:30 homesrv sshd[5484]: debug1: do_cleanup
Sep 11 12:37:30 homesrv sshd[5484]: Transferred: sent 3480, received 1840 bytes
Sep 11 12:37:30 homesrv sshd[5484]: Closing connection to 10.0.0.201 port 33530
Sep 11 12:37:30 homesrv sshd[5481]: debug1: PAM: cleanup
Sep 11 12:37:30 homesrv sshd[5481]: debug1: PAM: deleting credentials
Sep 11 12:37:30 homesrv sshd[5481]: debug1: PAM: closing session
Sep 11 12:37:30 homesrv sshd[5481]: pam_unix(sshd:session): session closed for user mathias

Besteht die Möglichkeit das mitzuloggen einfach nicht oder mach ich was falsch?

cu
serow
 
$ man sshd_config
[...]
Code: 
     LogLevel
             Gives the verbosity level that is used when logging messages from
             sshd(8).  The possible values are: QUIET, FATAL, ERROR, INFO,
             VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  The default is INFO.
             DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
             higher levels of debugging output.  Logging with a DEBUG level
             violates the privacy of users and is not recommended.
[...]
 
Ehh ja - danke für nichts. Prinzipiell zu unterstellen, dass jeder der was bzgl Linux fragt die man page nicht angeschaut hat finde ich relativ unverschämt.

Falls du auf DEBUG3 anspielst: macht keinen Unterschied


cu
serow
 
Original von xeno
soweit ich weiß unterstützt openssh kein filetransfer logging, weder über scp noch über sftp. ich kann mich aber natürlich auch irren.
Zum Vergrößern anklicken....

Original von OpenSSH FAQ
The OpenSSH suite includes the ssh(1) program which replaces rlogin and telnet, and scp(1) which replaces rcp(1) and ftp(1). OpenSSH has also added sftp(1) and sftp-server(8) which implement an easier solution for file-transfer. This is based upon the secsh-filexfer IETF draft.
Zum Vergrößern anklicken....

Laut der FAQ geht es:

http://www.openssh.com/faq.html

http://sftpfilecontrol.sourceforge.net/

http://sftplogging.sourceforge.net/

http://hp.kairaven.de/scpsftp/ssh-rssh-sftp.html

Grüße

Zephyros
 
Der letzte Link erklärt alles Schritt für Schritt, auch die Anpassung der sshd_config etc.

Out-of-the-Box geht es nicht, dass ist richtig. Aber ohne Fummeln und in Configs Rum schrauben macht Linux eh keinen Spaß :D

Grüße

Zephyros
 
Original von Serow
Ehh ja - danke für nichts. Prinzipiell zu unterstellen, dass jeder der was bzgl Linux fragt die man page nicht angeschaut hat finde ich relativ unverschämt.
Zum Vergrößern anklicken....

Und woher soll ich bitte wissen, dass du es nicht ausprobiert hast? Meine Güte, es hätte auch ein einfaches "Danke, hatte ich versucht, hat nichts gebracht" gereicht, anstatt hier gleich den großen Oberhacker raushängen zu lassen. Das war das letzte Mal, dass ich mich zu irgendeinem deiner Themen in irgendeiner Form äussern werde.
 
Um antworten zu können musst du eingeloggt sein.
Zurück
Oben