Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am exploring ways to capture the remote login events in my Linux server [ Oracle Linux 5x ]. Many users are connecting to the server using rcp and rsh protocols , I wish to capture the events [ such as- server from where they are logging, unix id, file details for rcp ]

In my syslog.conf I am capturing the following details. local7.* /var/log/ftplogs authpriv.* /var/log/sftplog

Am I missing any facilities.

share|improve this question
    
The question(s) you have to ask yourself: are those events showing up in any of my systems current logs? If so, by which means of syslog did they get there? –  tink Mar 30 '13 at 19:19
    
I am able to get the ssh/ftp/scp events in my syslog logfiles. The issue is only with rcp and rsh –  Balualways Mar 31 '13 at 23:58
    
One wild idea is to rename and replace the rcp and rsh commands by scripts that will do the logging and then call the real command. –  harrymc Apr 3 '13 at 13:06

1 Answer 1

you need to start rshd with -L switch on server_args parameter within xinetd.conf:

service shell {
                disable        = no
                socket_type    = stream 
                wait           = no 
                user           = root
                log_on_success += USERID
                log_on_failure += USERID
                server         = /usr/sbin/in.rshd 
                server_args    = -L
              }
share|improve this answer
    
I already have this information in my xinetd.conf –  Balualways Apr 4 '13 at 16:42
    
I have a logrotate on the log file, after the rotate few information like rsh are not being captured in the log. Looks like after each rotate I need to restart the syslog service. –  Balualways Apr 4 '13 at 16:45
    
Thanks for the details marcel - I am just curious what does the "log_on_success += USERID" will do in your xinetd.conf –  Balualways Apr 4 '13 at 16:47
    
So maybe your question's regarding logrotate not keeping to log after rotate? I know logrotate has some issues when SIGUSR1 not being sent to the PID, but I don't know for sure. Might want to google some. –  Marcel Apr 4 '13 at 20:45
    
By adding the following in the logrotate file [ postrotate ; /bin/kill -HUP cat /var/run/syslogd.pid 2> /dev/null 2> ] , The syslog started capturing the auth.info correctly which enables the rcp and rsh- Thanks –  Balualways Apr 5 '13 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.