1

Basically, I want to log each and every file which is sent or received via SCP on the server.

Let say a user does a SCP from Server-1 to Server-2. I figured out the way to get logs on senders side, but how to get what is been transferred on the receiver's side?

I want the logs on the receiver's side containing the names of the files which are transferred to it via SCP.

Also to get logs on senders side I am using my bash script which first save the filename to a log file and then use SCP to transfer it. Is there any better approach to do so.

Thanks in advance for any suggestion.

5 Answers 5

2

I just found an interesting soloution others might be interested in:

When using scp it actually also calles the binary on the Server with the -f flag. This means that one can write a simple wrapper for the server-side scp, like this:

First change your original scp's name:

mv /usr/bin/scp /usr/bin/scp-org

Than create a simple scripte in its name:

sudo nano /usr/bin/scp

with the contents:

#/bin/bash

scp-org $@ | tee >(grep -aEo "[CD][0-7]{4} [0-9]* .*$" --line-buffered >> /var/log/scp.log)

This could of course be refined, but it works as a example. You can now use tail -f /var/log/scp.log and see all files beeing transfered in real time

0

You can try replacing the scp command on the server by a modified version that does what you need. scp is a very simple program and adding some logging code to it shouldn't be a daunting task.

0

You're probably using the OpenSSH software package. The OpenSSH scp utility doesn't log anything. It supports debugging output for the underlying SSH session, but that won't log the actual file transfers which are taking place.

Similarly, the OpenSSH server can be set to log detail about what it's doing, and it can be set to log the fact that a user connected and ran scp, but it won't log the actual file transfers which are taking place.

If you can't get these users to use SFTP instead, there are three approaches available to you:

  1. Investigate alternative (in other words, commercial) SSH/SFTP/SCP servers. They should generally support logging file transfers.

  2. Replace the scp utility on the server with one that logs the data you want. OpenSSH is open source. Someone who knows how to program in C for Unix could download the source and modify it.

  3. Replace the scp utility with a "wrapper" that launches the original scp program and monitors what it does. There are debugging tools for Unix which can monitor what another process is doing.

I needed to log scp transfers once, and I used the third approach. I wrote a Perl script which launched the original scp program under strace. Strace would output the names of files being opened and closed by the scp process. The Perl script parsed the strace output and figured out what files were being transferred.

0

@Cube 's solution is partially correct because on the server side, scp is run as the SSH user (not root), so it does not have the permission to append to the log file /var/log/scp.log. You need to do something like this in order to log into /var/log/auth.log .

#!/bin/bash
logger -p auth.info "SCP `date` $@"
scp "$@"

Modify the -p option to change destination log file and designated log level.

0

I believe the solutions suggesting to make a wrapper around the scp binary on the server are not going to work with recent scp clients.

Since OpenSSH 8.8 (8.7 in Red Hat/Fedora builds), scp has use the SFTP protocol for transfers by default.

For such newer clients, this mechanism of wrapping the scp on the server will only work if the client is invoking scp with the -O flag (to enforce the old protocol).

For such needs, maybe using rsync instead of scp could help? rsync seems to have the ability of logging file accesses: from the rsyncd.conf man page:

log format
This parameter allows you to specify the format used for logging file transfers when transfer logging is enabled.
[..]
%f the filename (long form on sender; no trailing lq/rq)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.