Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am exploring ways to capture the remote login events in my Linux server [ Oracle Linux 5x ]. Many users are connecting to the server using rcp and rsh protocols , I wish to capture the events [ such as- server from where they are logging, unix id, file details for rcp ]

In my syslog.conf I am capturing the following details. local7.* /var/log/ftplogs authpriv.* /var/log/sftplog

Am I missing any facilities.

share|improve this question
    
The question(s) you have to ask yourself: are those events showing up in any of my systems current logs? If so, by which means of syslog did they get there? – tink Mar 30 '13 at 19:19
    
I am able to get the ssh/ftp/scp events in my syslog logfiles. The issue is only with rcp and rsh – Balualways Mar 31 '13 at 23:58
    
One wild idea is to rename and replace the rcp and rsh commands by scripts that will do the logging and then call the real command. – harrymc Apr 3 '13 at 13:06

you need to start rshd with -L switch on server_args parameter within xinetd.conf:

service shell {
                disable        = no
                socket_type    = stream 
                wait           = no 
                user           = root
                log_on_success += USERID
                log_on_failure += USERID
                server         = /usr/sbin/in.rshd 
                server_args    = -L
              }
share|improve this answer
    
I already have this information in my xinetd.conf – Balualways Apr 4 '13 at 16:42
    
I have a logrotate on the log file, after the rotate few information like rsh are not being captured in the log. Looks like after each rotate I need to restart the syslog service. – Balualways Apr 4 '13 at 16:45
    
Thanks for the details marcel - I am just curious what does the "log_on_success += USERID" will do in your xinetd.conf – Balualways Apr 4 '13 at 16:47
    
So maybe your question's regarding logrotate not keeping to log after rotate? I know logrotate has some issues when SIGUSR1 not being sent to the PID, but I don't know for sure. Might want to google some. – Marcel Apr 4 '13 at 20:45
    
By adding the following in the logrotate file [ postrotate ; /bin/kill -HUP cat /var/run/syslogd.pid 2> /dev/null 2> ] , The syslog started capturing the auth.info correctly which enables the rcp and rsh- Thanks – Balualways Apr 5 '13 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .