How to capture the remote [ rsh/rcp ] login events and information using syslog.conf

Question

I am exploring ways to capture the remote login events in my Linux server [ Oracle Linux 5x ]. Many users are connecting to the server using rcp and rsh protocols , I wish to capture the events [ such as- server from where they are logging, unix id, file details for rcp ]

In my syslog.conf I am capturing the following details. local7.* /var/log/ftplogs authpriv.* /var/log/sftplog

Am I missing any facilities.

Answer 1

you need to start rshd with -L switch on server_args parameter within xinetd.conf:

service shell {
                disable        = no
                socket_type    = stream 
                wait           = no 
                user           = root
                log_on_success += USERID
                log_on_failure += USERID
                server         = /usr/sbin/in.rshd 
                server_args    = -L
              }