Finding sshd log file

Question

I'm experiencing some problems with SSHD on my server. I'm trying to set up passwordless (pub/pv keys) authentication. It worked for my other servers, but not for this one. The SSHD agent adds my public key in "authorized keys" but still asks for password. I tried to disable totally password authentication (in /etc/ssh/sshd_conf) to see what happens, and I get "bad pub key".

The pub key is sent by the client (ssh -vvv) :

 ----
 debug1: Next authentication method: publickey
 debug1: Offering RSA public key: /home/me/.ssh/id_rsa
 debug3: send_pubkey_test
 debug2: we sent a publickey packet, wait for reply
 debug1: Authentications that can continue: publickey,password
 debug1: Trying private key: /home/me/.ssh/id_dsa
 ----
 ## Next key (rsa was the good one)

I checked "sshd_config" and ".ssh" permissions Now I just want to be able to see what happens on the server side. I checked my "/var/log/auth" and "/var/log/secure", but no file here.

In the config, I configured logs as follows :

 SyslogFacility AUTH
 LogLevel DEBUG

How can I debug my situation without using deep network sniffing ? Is it possible to redirect Sshd output to a logfile or std ?

Thank you

Answer 1

The way to see what is going on on the server is to start the sshd daemon with these options:

  /usr/sbin/sshd -dD 

The two options are (from the Man page):

-D When this option is specified, sshd will not detach and does not become a daemon. This allows easy monitoring of sshd.

-d      Debug mode.  The server sends verbose debug output to standard error, and does not put itself in the
         background.  The server also will not fork and will only process one connection.  This option is only
         intended for debugging for the server.  Multiple -d options increase the debugging level.  Maximum is
         3.

This should be plenty. For the past, it depends on your distro. I get messages in /var/log/auth.log, but you can search for messages relating to ssh in the same directory by means of

    find /var/log -type f -exec grep -l ssh {} \;

which will output the names of all files containing the expression ssh. You will then have to check their content.

Answer 2

You write How can I debug my situation without using deep network sniffing ? Is it possible to redirect Sshd output to a logfile or std ?"

Well, you could include in your troubleshooting and question, noting down how you created the key, and how you put the key into authorized_keys on the remote side. And the permissions Permissions on private key in .ssh folder?

My answer to this question

When I try to log in with SSH, why am I getting the error, Permission denied (publickey)

includes an example of redirecting the -v output to a file $ ssh -v user@ip pwd 2>a.a along with some things to look for to catch a public key issue or an incorrect user issue.