[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: intrusion via ssh



Salut Angelina,

Am 2005-03-31 13:08:27, schrieb Angelina Carlton:

> Hi Michelle, 
> can you descibe to me how to make all sshd activity log
> to /var/log/sshd.log ? My woody server logs it auth.log
> which is fine I suppose but I woul much rather have sshd.log

Right...
I have create three (postgresql, spamd, sshd) seperate logentries...

> my sshd_config has:
> 
> # Logging                                                                                                            
> SyslogFacility AUTH                                                                                                  
> LogLevel INFO    

SyslogFacility LOCAL1


  __( '/etc/syslog.conf' )______________________________________________
 /
| local0.*                        -/var/log/postgresql.log
| local1.*                        -/var/log/sshd.log
| local4.*                        -/var/log/spamd.log
 \______________________________________________________________________


/etc/init.d/sysklogd restart
/etc/init.d/ssh restart


> I would imagine that needs changing to something, but syslog would need to 
> be changed also? and what about logrotate?

Create an entry for logrotate:

  __( '/etc/logrotate.d/sshd' )___________________
 /
| /var/log/sshd*.log {
| 	weekly
| 	missingok
| 	rotate 52
| 	compress
| 	delaycompress
| 	notifempty
| 	create 640 root adm
| 	sharedscripts
| 	postrotate
| 		/etc/init.d/ssh reload > /dev/null
| 	endscript
| }
 \________________________________________________


> TIA

Greetings
Michelle

-- 
Linux-User #280138 with the Linux Counter, http://counter.li.org/ 
Michelle Konzack   Apt. 917                  ICQ #328449886
                   50, rue de Soultz         MSM LinuxMichi
0033/3/88452356    67100 Strasbourg/France   IRC #Debian (irc.icq.com)

Attachment: signature.pgp
Description: Digital signature


Reply to: