How to have a log for sshd?

xpucto · 06-02-2008, 08:12 AM

Hi!

I run FC as a server and would like to have a log for my sshd. How may I do this?

thanks

Tux-Slack · 06-02-2008, 08:21 AM

ssh is normaly logged by default.
Check the /etc/ssh/sshd_conf file for more info.

tommyr1216 · 06-02-2008, 01:58 PM

In Fedora, /var/log/secure contains the sshd log. It will tell you who tried to log in, whether they succeeded, etc..

Ajax4Hire · 06-02-2008, 03:08 PM

last also contains a list of successful and failed login attempts via ssh (as well as Desktop).

>last -f /var/log/btmp

lastb is a short cut for the above command.
To list by ip address:
lastb -i or
last -i -f /var/log/btmp

This output is easier to scan for failed login attempts.
To stop hacking via ssh try denyhost, works great.

xpucto · 06-03-2008, 05:37 AM

Quote:

Originally Posted by Ajax4Hire

last also contains a list of successful and failed login attempts via ssh (as well as Desktop).

>last -f /var/log/btmp

lastb is a short cut for the above command.
To list by ip address:
lastb -i or
last -i -f /var/log/btmp

This output is easier to scan for failed login attempts.
To stop hacking via ssh try denyhost, works great.

really cool commands thanks!

The thing is that I configured iptables in such a way that only a few ips are allowed to login. Only those allowed ips are showed in the logs. But I would like also to see all the other failed attempts which have been blocked through the firewall. Ok, now that I'm writing this, it becomes me clear that I'm looking in the wrong log files! Where should I look to find those failed login attempts? Where are the iptables'log files?

thanks