1

I'm trying to log activity (uploads, downloads, renames, deletes) for SFTP users. If I SFTP with a normal user, it logs to /var/log/secure. If I SFTP with a rssh user, it logs that they connected, but nothing else.

In /var/log/messages it shows:

rssh[8287]: setting log facility to LOG_USER
rssh[8287]: allowing scp to all users
rssh[8287]: allowing sftp to all users
rssh[8287]: allowing rsync to all users
rssh[8287]: setting umask to 022
rssh[8287]: chrooting all users to /home/data
rssh[8287]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE"
rssh_chroot_helper[8287]: new session for USERNAME, UID=721
rssh_chroot_helper[8287]: user's home dir is /home/data/home/USERNAME
rssh_chroot_helper[8287]: chrooted to /home/data
rssh_chroot_helper[8287]: changing working directory to /home/USERNAME (inside jail)

/etc/ssh/sshd_config

SyslogFacility AUTHPRIV LogLevel DEBUG Subsystem       sftp   
/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE

/etc/syslog.conf

authpriv.*                                             
/var/log/secure

I've tried to find a solution online, but nothing seems to work. I tried doing the following with a link set to /dev/log and /var/log/secure, but neither worked.

/etc/sysconfig/syslog

SYSLOGD_OPTIONS="-m 0 -a /home/data/home/USERNAME/dev/log"

0

You must log in to answer this question.

Browse other questions tagged .