Find the answer to your Linux question:
Results 1 to 7 of 7
Hi Guys, I've just started up my own ssh server (you can read about the whole sorry affair in this thread ), and I'm feeling a little paranoid, so I'd ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Guru smolloy's Avatar
    Join Date
    Apr 2005
    Location
    CA, but from N.Ireland
    Posts
    2,414

    Where are sshd logs kept?


    Hi Guys,
    I've just started up my own ssh server (you can read about the whole sorry affair in this thread ), and I'm feeling a little paranoid, so I'd like to have a look at the ssh logs to see failed login attempts, script kids trying to brute-force a connection, etc., but I can't find the logs at all!!

    Some sites I've found have said that the logs should be at /var/log/secure, but this file doesn't exist on my machine.

    Can anyone give me a hint where to find them?

    Thanks.
    Registered Linux user #388328 || Registered LFS user #15880
    AMD 64 X2 4600+ :: 2X1GB DDR2 800 :: GeForce 9400 GT 512MB :: ASUS M2N32 Deluxe :: 4X250GB SATAII
    Need instant help? Try us on IRC -- #linuxforums on freenode

  2. #2
    Linux Engineer Zelmo's Avatar
    Join Date
    Jan 2006
    Location
    Riverton, UT, USA
    Posts
    1,001
    From searching through the sshd man page, it looks like the log reports are supposed to go to the system log (/var/log/syslog). However, my syslog shows no log reports from sshd, even though I ssh into my machine daily. So you may need to turn up the logging level in your config to see the reports you want. Try changing the LogLevel to VERBOSE, or check the man page for sshd_config for more options (under the LogLevel description).
    Stand up and be counted as a Linux user!

  3. #3
    Linux Guru smolloy's Avatar
    Join Date
    Apr 2005
    Location
    CA, but from N.Ireland
    Posts
    2,414
    Thanks Zelmo.

    I don't seem to have that file (/var/log/syslog). Maybe SUSE keeps it somewhere different?
    Registered Linux user #388328 || Registered LFS user #15880
    AMD 64 X2 4600+ :: 2X1GB DDR2 800 :: GeForce 9400 GT 512MB :: ASUS M2N32 Deluxe :: 4X250GB SATAII
    Need instant help? Try us on IRC -- #linuxforums on freenode

  4. $spacer_open
    $spacer_close
  5. #4
    Linux Guru bigtomrodney's Avatar
    Join Date
    Nov 2004
    Location
    Ireland
    Posts
    6,133
    You can find most of what you're looking for in /var/log/messages , which is where SUSE usually puts things. I usually run the following three searches with root privelage to get a good picture
    Code:
    grep -ir ssh /var/log/*
    grep -ir breakin /var/log/*
    grep -ir security /var/log/*

  6. #5
    Linux Guru smolloy's Avatar
    Join Date
    Apr 2005
    Location
    CA, but from N.Ireland
    Posts
    2,414
    Thanks bigtom.

    Wow. Looks like someone tried to log in with a long list of usernames on sunday morning. Looks like several hundred attempts in less than 10 minutes!

    Luckily I only allow the one user, and don't allow password authentication, so I guess I'm safe from these kind of attacks -- thanks to everyone's advice here!!!

    Scary though....
    Registered Linux user #388328 || Registered LFS user #15880
    AMD 64 X2 4600+ :: 2X1GB DDR2 800 :: GeForce 9400 GT 512MB :: ASUS M2N32 Deluxe :: 4X250GB SATAII
    Need instant help? Try us on IRC -- #linuxforums on freenode

  7. #6
    Just Joined!
    Join Date
    May 2013
    Posts
    1
    Thanks Bigtomrodney. I am using a dedicated server and it was hanged on may 20th. I wanted to find the root cause using SSH. when i use any of the commands (grep -ir ssh /var/log/*
    grep -ir breakin /var/log/*
    grep -ir security /var/log/*)
    lot of content is displayed which is confusing. Please can help me with this.

  8. #7
    Linux Guru smolloy's Avatar
    Join Date
    Apr 2005
    Location
    CA, but from N.Ireland
    Posts
    2,414
    Holy super mega thread resurrection Batman!!

    This conversation is almost 7 years old!!! Maybe it would be a good idea to start another thread?
    Registered Linux user #388328 || Registered LFS user #15880
    AMD 64 X2 4600+ :: 2X1GB DDR2 800 :: GeForce 9400 GT 512MB :: ASUS M2N32 Deluxe :: 4X250GB SATAII
    Need instant help? Try us on IRC -- #linuxforums on freenode

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •