Viewing SSH access in Fedora

jax8 · 07-08-2010, 11:21 PM

How can I display the IP addresses that have accessed my Fedora machine via SSH? In particular i want to know if they logged in and what they may have done while logged in. thanks.

chrism01 · 07-08-2010, 11:35 PM

All the sshd server options are here http://www.openbsd.org/cgi-bin/man.c...sshd&sektion=8 .

Quote:

-q Quiet mode. Nothing is sent to the system log. Normally the
beginning, authentication, and termination of each connection is
logged.

See chap 17 http://www.linuxtopia.org/online_boo...ion/index.html
It should log to /var/log/secure if available, or /var/log/messages otherwise.
See syslog.conf

anomie · 07-09-2010, 02:11 PM

By default, Fedora logs ssh authentication attempts to /var/log/secure. That information includes user name, host name (which may be spoofed), and IP address.

Figuring out what they may have done? That's another story.