Logging logins only?
From: Blair Steenerson (blair_at_steenerson.com)
Date: Tue, 09 Nov 2004 04:23:11 -0600 To: email@example.com
Hi all. I've been reading this list for a while, and have followed the
discussion of the automated probes that have become pretty common
against SSH servers. Same deal here.
I have a couple boxes using SSH which log to a central syslog server. I
want to be able to keep track of who and when people login to these
boxes, but since my logs are now filled up with thousands of lines of
login errors (illegal user, not in allow list, etc), its getting to be a
pain to sort through the garbage to keep track of what I want (not to
mention a major waste of paper on the syslogd printer)
What I want to do is log only successful logins, but not all the script
kiddie's probing - I know they are there, I can deal with that. None of
INFO, ERROR, FATAL or QUIET does the job. Unfortunately my programming
skills suck or I would dig in myself....
Maybe someone here has a suggestion short of that? Or maybe I have
missed some trick somewhere?
Thanks for your time, and keep up the good work.
Version is OpenSSH 3.8p1, not using PAM