Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to log activity (uploads, downloads, renames, deletes) for SFTP users. If I SFTP with a normal user, it logs to /var/log/secure. If I SFTP with a rssh user, it logs that they connected, but nothing else.

In /var/log/messages it shows:

rssh[8287]: setting log facility to LOG_USER
rssh[8287]: allowing scp to all users
rssh[8287]: allowing sftp to all users
rssh[8287]: allowing rsync to all users
rssh[8287]: setting umask to 022
rssh[8287]: chrooting all users to /home/data
rssh[8287]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE"
rssh_chroot_helper[8287]: new session for USERNAME, UID=721
rssh_chroot_helper[8287]: user's home dir is /home/data/home/USERNAME
rssh_chroot_helper[8287]: chrooted to /home/data
rssh_chroot_helper[8287]: changing working directory to /home/USERNAME (inside jail)

/etc/ssh/sshd_config

SyslogFacility AUTHPRIV LogLevel DEBUG Subsystem       sftp   
/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE

/etc/syslog.conf

authpriv.*                                             
/var/log/secure

I've tried to find a solution online, but nothing seems to work. I tried doing the following with a link set to /dev/log and /var/log/secure, but neither worked.

/etc/sysconfig/syslog

SYSLOGD_OPTIONS="-m 0 -a /home/data/home/USERNAME/dev/log"
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.