如何做sshd的日志记录？

landker

在linux上装了sshd服务器，也可以通过其日志设置获知有用户通过ssh的方式登录服务器，但用户ssh登陆后到底做了什么，日志似乎没记录。这个该如何设置？

windoze

把sshd_config里面的LogLevel设成VERBOSE

1. 
   
2. LogLevel VERBOSE
   

复制代码

然后重启sshd服务

landker

windoze 发表于 2017-07-08 16:41
把sshd_config里面的LogLevel设成VERBOSE

然后重启sshd服务

谢谢你的回复，

但还是不行，是我操作有误吗？具体如下：

1、设置：
1）vi /etc/ssh/sshd_config

1. #LogLevel INFO
   
2. LogLevel VERBOSE
   
3. 
   
4. #SyslogFacility AUTH
   
5. SyslogFacility local5
   

复制代码

2）vi /etc/rsyslog.conf

1. local5.* /data/log/sshd.log

复制代码

3）重启服务
sudo service ssh restart
sudo restart rsyslog

2、客户端（192.168.1.5）登录测试

1. > ssh -l test 192.168.1.5
   
2. > cd test_dir
   
3. > touch fff.txt
   
4. > echo "sss" > fff.txt
   
5. > more fff.txt
   
6. > exit

复制代码

3、sshd服务器的日志记录（里面并没有上面第2点中的指令操作过程）：

1. 2017-07-09T11:40:18.471257+08:00 test sshd[669]: Received signal 15; terminating.
   
2. 2017-07-09T11:40:18.560727+08:00 test sshd[884]: Server listening on 0.0.0.0 port 22.
   
3. 2017-07-09T11:40:18.561022+08:00 test sshd[884]: Server listening on :: port 22.
   
4. 2017-07-09T11:49:10.738852+08:00 test sshd[884]: Received signal 15; terminating.
   
5. 2017-07-09T11:49:10.767079+08:00 test sshd[2611]: Set /proc/self/oom_score_adj from 0 to -1000
   
6. 2017-07-09T11:49:10.767324+08:00 test sshd[2611]: Server listening on 0.0.0.0 port 22.
   
7. 2017-07-09T11:49:10.767501+08:00 test sshd[2611]: Server listening on :: port 22.
   
8. 2017-07-09T11:50:10.190652+08:00 test sshd[2698]: Set /proc/self/oom_score_adj to 0
   
9. 2017-07-09T11:50:10.203200+08:00 test sshd[2698]: Connection from 192.168.1.5 port 49090
   
10. 2017-07-09T11:50:14.701265+08:00 test sshd[2698]: Accepted password for test from 192.168.1.5 port 49090 ssh2
    
11. 2017-07-09T11:50:14.976291+08:00 test sshd[2698]: User child is on pid 2861
    
12. 2017-07-09T11:50:19.402004+08:00 test sshd[2861]: Received disconnect from 192.168.1.5: 11: disconnected by user
    
13. 2017-07-09T11:50:58.171159+08:00 test sshd[2983]: Set /proc/self/oom_score_adj to 0
    
14. 2017-07-09T11:50:58.204194+08:00 test sshd[2983]: Connection from 192.168.1.5 port 49092
    
15. 2017-07-09T11:51:00.612260+08:00 test sshd[2983]: Accepted password for test from 192.168.1.5 port 49092 ssh2
    
16. 2017-07-09T11:51:01.096976+08:00 test sshd[2983]: User child is on pid 3161
    
17. 2017-07-09T11:51:30.185071+08:00 test sshd[3161]: Received disconnect from 192.168.1.5: 11: disconnected by user

复制代码

windoze

回复 3# landker

errrr……你要的是用户登录以后的日志？我还以为你就要登录日志……
用户登录以后sshd进程就执行shell了，这玩意儿貌似没日志，你得想别的办法，比如GNU acct之类的审计工具。

https://www.gnu.org/software/acct/
https://www.tecmint.com/how-to-m ... acct-or-acct-tools/

lxyscls

回复 1# landker

cat ~/.bash_history
具体就是配置bash，好像还可以把hostname什么的都给记进来

你可以到shell区问问