Logging logins only?

From: Blair Steenerson (blair_at_steenerson.com)
Date: 11/09/04

  • Next message: David Roman Esteban: "Re: Logging logins only?" 
    Date: Tue, 09 Nov 2004 04:23:11 -0600
To: secureshell@securityfocus.com

    Hi all. I've been reading this list for a while, and have followed the
    discussion of the automated probes that have become pretty common
    against SSH servers. Same deal here.

    I have a couple boxes using SSH which log to a central syslog server. I
    want to be able to keep track of who and when people login to these
    boxes, but since my logs are now filled up with thousands of lines of
    login errors (illegal user, not in allow list, etc), its getting to be a
    pain to sort through the garbage to keep track of what I want (not to
    mention a major waste of paper on the syslogd printer)

    What I want to do is log only successful logins, but not all the script
    kiddie's probing - I know they are there, I can deal with that. None of
    INFO, ERROR, FATAL or QUIET does the job. Unfortunately my programming
    skills suck or I would dig in myself....

    Maybe someone here has a suggestion short of that? Or maybe I have
    missed some trick somewhere?

    Thanks for your time, and keep up the good work.

    Version is OpenSSH 3.8p1, not using PAM

    Blair

  • Next message: David Roman Esteban: "Re: Logging logins only?"

    Relevant Pages