I'm trying to log activity (uploads, downloads, renames, deletes) for SFTP users.
If I SFTP with a normal user, it logs to /var/log/secure
.
If I SFTP with a rssh user, it logs that they connected, but nothing else.
In /var/log/messages it shows:
rssh[8287]: setting log facility to LOG_USER
rssh[8287]: allowing scp to all users
rssh[8287]: allowing sftp to all users
rssh[8287]: allowing rsync to all users
rssh[8287]: setting umask to 022
rssh[8287]: chrooting all users to /home/data
rssh[8287]: chroot cmd line: /usr/local/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE"
rssh_chroot_helper[8287]: new session for USERNAME, UID=721
rssh_chroot_helper[8287]: user's home dir is /home/data/home/USERNAME
rssh_chroot_helper[8287]: chrooted to /home/data
rssh_chroot_helper[8287]: changing working directory to /home/USERNAME (inside jail)
/etc/ssh/sshd_config
SyslogFacility AUTHPRIV LogLevel DEBUG Subsystem sftp
/usr/libexec/openssh/sftp-server -f AUTHPRIV -l VERBOSE
/etc/syslog.conf
authpriv.*
/var/log/secure
I've tried to find a solution online, but nothing seems to work. I tried doing the following with a link set to /dev/log
and /var/log/secure
, but neither worked.
/etc/sysconfig/syslog
SYSLOGD_OPTIONS="-m 0 -a /home/data/home/USERNAME/dev/log"