Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to go failed (either incorrect username, password, or both) on my server.

I changed /etc/ssh/sshd_config from

# Logging
SyslogFacility AUTH 
LogLevel INFO

to

# Logging
SyslogFacility AUTH 
LogLevel VERBOSE

and have since tried multiple ssh attempts with both existing and non-exisiting users with random passwords thus failing. When checking /var/log/auth.log nothing appears and it is entirely blank.

What am I missing? Does some other process need to also be install and running on my system? I'm running Ubuntu.

Any help or guidance on this matter is more than welcome.

Thanks

share|improve this question

migrated from stackoverflow.com Dec 4 '12 at 1:58

This question came from our site for professional and enthusiast programmers.

    
This question is best suited for serverfault.com –  Bot Dec 3 '12 at 22:15
add comment

1 Answer 1

up vote 1 down vote accepted

In general, you need a system logger. Some distributions ship with syslog-ng now days which is a complex, but flexible service for logging. It should be noted that the minimum configuration to get the described effect is not that complex:

   source src {
       unix-stream("/dev/log");
       internal();
   };
   source kernsrc {
       file("/proc/kmsg");
   };

   destination authlog { file("/var/log/auth.log"); };
   filter f_authpriv { facility(auth, authpriv); };
   log { source(src); filter(f_authpriv); destination(authlog); };

According to the Ubuntu community wiki, the default logging daemon is not syslog-ng in Ubuntu and the configuration file format is not as in the example above. I suggest you consider both options and pick the one which suits your needs.

After making the decision, you will need to run the logger service. Use either the service binary or run the script in /etc/init.d with the start argument. Look at this answer for hints.

share|improve this answer
    
Brilliant. I installed syslog-ng sudo apt-get install syslog-ng and the defaults were enough. I have also installed sshguard with it. Thanks for your help :-) –  edwardgd Dec 4 '12 at 10:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.