WinSCP and SCP connection Info

[farooqhussain]

Recently I have assign a new job from by boss to keep track WinSCP and scp connection information. Means if a users is connected from WinSCP or scp I have to keep track that what they do means in which files they made changes, what file they deleted or what file they copy using winscp or scp connection on there server and that command they are executing. I want record every thing what they do on server.

Is there any way to keep track this information. Your suggestion in this regard is hight appreciated.

[atreyu]

Is there any way to keep track this information. Your suggestion in this regard is hight appreciated.

I thought this would be as easy as changing LogLevel to VERBOSE or DEBUG3 in sshd_config, but nope - at least on my Fedora/CentOS boxes.

Try the sftpfilecontrol patch to get that kind of logging capability. you'll have to d/l the source openssh package and apply this patch to that - you ought to use the source package specifically for your distro, if you can.

[farooqhussain]

For SFTP and WinSCP Logging. Please replace the following line in /etc/ssh/sshd_config

Subsystem sftp /usr/lib/openssh/sftp-server

with

Subsystem sftp /usr/lib/openssh/sftp-server -l INFO

Now how to I enable SSH and SCP logging for you access the file or change is permissions or removed it

Is there any why to do this

[atreyu]

For SFTP and WinSCP Logging. Please replace the following line in /etc/ssh/sshd_config

Subsystem sftp /usr/lib/openssh/sftp-server

with

Subsystem sftp /usr/lib/openssh/sftp-server -l INFO

Yeah, that does work for SFTP logging - WinSCP is using SFTP to attach to your SSH server, not SCP, as you may have guessed. To enable logging of the SSH/SCP sessions, I'd try the patch I suggested. I know of no way native to OpenSSH to do that.

[farooqhussain]

Yeah, that does work for SFTP logging - WinSCP is using SFTP to attach to your SSH server, not SCP, as you may have guessed. To enable logging of the SSH/SCP sessions, I'd try the patch I suggested. I know of no way native to OpenSSH to do that.

Thanks atreyu. I used incrontab for this purpose for time being its working for me