Re: Auditing SSH logs



On 6/4/07, Darren Tucker <dtucker@xxxxxxxxxx> wrote:
Flavio Junior wrote:
> Hi folks, good morning/afternoon/evening ;)
>
> I'll try explain my doubt, but sorry for my english..
>
> Can someone tell me if has a way to do SSHD log shows me "which" key
> has been accepted when logged as root ?
>
> Example:
> "May 31 15:15:17 lazlo sshd[12583]: Accepted publickey for root from
> 192.168.4.192 port 1835 ssh2"
>
> But ... which key has been accepted ? how can i audit something like
> it, if i have more than a single key on authorized_keys for root

Set "LogLevel verbose" in sshd_config and you'll get the key fingerprint
logged in syslog too ("Found matching RSA key: XX:XX..")

Hm...
This is, at least, an improvenment :)

But, how can i do to discover from which key is some fingerprint ?

Thanks again ;)


Flavio do Carmo Junior



Relevant Pages

  • Re: Armenian, Sumerian, Burushaski, and Turkic languages
    ... Some affixes will only be suspected affixes. ... identification of IE root-extensions and Semitic root extensions (i.e. ... was enough to demonstrate that English and Bengali ... I knew Alexis Manaster Ramer. ...
    (sci.lang)
  • Re: The original non Indo-European languages of Europe
    ... roots compared to over 2 million words in English and over 6 million words in Greek so if we take all the proto-Indo-European roots away we are left with nearly 2 million English words that are not ... If we then remove all the Latin words and the Greek words from English that have been borrowed then we should end up with only Celtic and Germanic words and similarly if all the Latin words are removed from French then were should end up with only Gaulish words. ... While it is possible to reconstruct a root for the Greek and Latin words Kunon and Canis and using the same rules used by proto-Indo-European theorists it could be possible to connect this root with a common root for Skilo and Kelev, which would indicate that its not an indo-European word at all, and you could probably even connect Kunon with and Bitch and Weibchen and even Hund with some root like *Webkhurdh it is obvious that Dog won't work. ...
    (soc.history.ancient)
  • Re: Armenian, Sumerian, Burushaski, and Turkic languages
    ... Matisoff knows not to use initial consonants in Tibeto-Burman ... Some affixes will only be suspected affixes. ... identification of IE root-extensions and Semitic root extensions (i.e. ... was enough to demonstrate that English and Bengali ...
    (sci.lang)
  • Re: Armenian, Sumerian, Burushaski, and Turkic languages
    ... Matisoff knows not to use initial consonants in Tibeto-Burman ... Some affixes will only be suspected affixes. ... identification of IE root-extensions and Semitic root extensions (i.e. ... was enough to demonstrate that English and Bengali ...
    (sci.lang)
  • Re: getting some clues
    ... More specifically the English speakers are not computer savvy ... they managed to muck up installing Chinese language support. ... You need to use the root ... > account to install things like the new mozilla. ...
    (alt.os.linux)