Hi All,
Where can I find the ssh logs the list of IPs connected (or failed) to the server?
Or I need to enable that on openssh? Where?
Right now, I can only see failed login on /var/log/messages like below
HTML Code:
Feb 5 17:30:12 localhost pam_tally[18936]: pam_tally: pam_get_uid; no such user admin
Feb 5 17:30:12 localhost PAM-Wheel[18936]: unknown user admin
Feb 5 17:33:59 localhost pam_tally[20027]: pam_tally: pam_get_uid; no such user admin2
Feb 5 17:33:59 localhost PAM-Wheel[20027]: unknown user admin2
Thank you for any comments you may add.
---------- Post updated at 05:46 PM ---------- Previous update was at 05:41 PM ----------
Still no luck. The admin user that I'm investigation is not on /var/log/secure*.
I wonder where it coming from, I checked all the crontab scripts, it's not there.
---------- Post updated at 06:15 PM ---------- Previous update was at 05:46 PM ----------
Where is this coming from
HTML Code:
Feb 5 17:30:12 localhost pam_tally[18936]: pam_tally: pam_get_uid; no such user admin
Feb 5 17:30:12 localhost PAM-Wheel[18936]: unknown user admin
No log on /var/log/secure. I tried ssh, ftp and sftp. Everything is being log on secure but the log coming from admin is no where log on secure. That admin2, I'm the one who did that but it's log on secure.