Visit Our UNIX and Linux User Community

Loggin SFTP activity for chrooted (rssh) users

Thread Tools Search this Thread
Operating Systems Linux Red Hat Loggin SFTP activity for chrooted (rssh) users
# 1  
Old 06-03-2011
Loggin SFTP activity for chrooted (rssh) users

Hi, I need to log the activity of my SFTP (RHEL 5.4).

I have this in /etc/sshd/sshd_config:
Subsystem       sftp    /usr/libexec/openssh/sftp-server -f LOCAL5 -l VERBOSE

And this in /etc/syslog.conf:
LOCAL5.*                                                /var/log/sftp.log

When I log in with a regular user, I get all the activity correctly logged in /var/log/sftp.log:
Jun  3 17:03:37 bpweb00001 sftp-server[13567]: session opened for local user John from []
Jun  3 17:03:37 bpweb00001 sftp-server[13567]: received client version 5
Jun  3 17:03:37 bpweb00001 sftp-server[13567]: realpath "."
Jun  3 17:03:37 bpweb00001 sftp-server[13567]: opendir "/home/John"
Jun  3 17:03:37 bpweb00001 sftp-server[13567]: closedir "/home/John"
Jun  3 17:14:16 bpweb00001 sftp-server[13567]: session closed for local user John from []

However, when I log in with a chrooted user, I get nothing in /var/log/sftp.log.
In /var/log/secure I get:
Jun  3 18:26:08 bpweb00001 sshd[18140]: Accepted password for TEST from xxx.xx.21.138 port 47748 ssh2
Jun  3 18:26:08 bpweb00001 sshd[18140]: pam_unix(sshd:session): session opened for user TEST by (uid=0)
Jun  3 18:26:08 bpweb00001 sshd[18144]: subsystem request for sftp
Jun  3 18:58:08 bpweb00001 sshd[18140]: pam_unix(sshd:session): session closed for user TEST

And in /var/log/messages:
Jun  3 18:27:44 bpweb00001 rssh[18168]: setting log facility to LOG_USER
Jun  3 18:27:44 bpweb00001 rssh[18168]: setting umask to 022
Jun  3 18:27:44 bpweb00001 rssh[18168]: line 66: configuring user TEST
Jun  3 18:27:44 bpweb00001 rssh[18168]: setting TEST's umask to 011
Jun  3 18:27:44 bpweb00001 rssh[18168]: allowing sftp to user TEST
Jun  3 18:27:44 bpweb00001 rssh[18168]: chrooting TEST to /chroot_dir
Jun  3 18:27:44 bpweb00001 rssh[18168]: chroot cmd line: /usr/libexec/rssh_chroot_helper 2 "/usr/libexec/openssh/sftp-server -f LOCAL5 -l VERBOSE"

The man page for sftp-server says: "For logging to work, sftp-server must be able to access /dev/log. Use of sftp-server in a chroot configuation there-
fore requires that syslogd(8) establish a logging socket inside the chroot directory."

So in /etc/sysconfig/syslog I did:
SYSLOGD_OPTIONS="-m 0 -a /chroot_dir/dev/log"

Restarted syslog and... nothing happened!

Can anyone tell me what am I doing wrong?

Thanks in advance.
# 2  
Old 06-03-2011
What's your system logger? Most of them don't have -a.

Is the chroot dir on the same filesystem as /dev/log ? you could make a hard-link.

Previous Thread | Next Thread
Test Your Knowledge in Computers #386
Difficulty: Medium
The Linux telnet command provides a user interface to a remote system using the SSH protocol.
True or False?

10 More Discussions You Might Find Interesting

1. Red Hat

Sftp server/chrooted trying to limit user permissions

I needed to set up an sftp server for an external user to upload data for an internal developer. What I did was created a chrooted user for the external guy, and then created an internal group with full permissions to that directory and then made the internal developer a member of that group so... (5 Replies)
Discussion started by: xdawg
5 Replies

2. UNIX for Advanced & Expert Users

Sftp user chrooted in a directory

Hello, I have a task to create 3 users that must connect only via sftp on a machine, and must have only read access to a certain directory (thay shouldn;t be able to cd anywhere else) The problem is that the directory where these users must have access to, it's already created/owned by another... (0 Replies)
Discussion started by: black_fender
0 Replies

3. Red Hat

Chroot sftp users, remote sftp login shows wrong timestamp on files

Hello, I have a weird issue, I have RHEL 5.7 running with openssh5.2 where sftpgroup OS group is chroot. I see the difference difference in timestamp on files, when I login via ssh and SFTP, I see four hour difference, is something missing in my configuration. #pwd... (8 Replies)
Discussion started by: bobby320
8 Replies

4. AIX

rssh not working in AIX 6.1

edit by bakunin: double post SNIPped. Hi, I have a similar problem with my AIX 6.1. In AIX 5.3, I have successfully implemented rssh for the caging of my SFTP users. Since we just upgraded to AIX 6.1 TL6 SP7, the rssh does not work. The SFTP works when the user's shell is set to ksh, but... (1 Reply)
Discussion started by: eddie.lee
1 Replies

5. UNIX for Advanced & Expert Users

chrooted SFTP upload folder

Hi List, I have set up a chrooted SFTP setup following the instructions I found on tech republic: /blog/opensource/chroot-users-with-openssh-an-easier-way-to-confine-users-to-their-home-directories/229 I have successfully got it all working and I can download files when logged in via sftp... (0 Replies)
Discussion started by: landossa
0 Replies

6. Linux

users can't sftp into my server

I am running a fedora core 13 server and I am having trouble with sftp. My users can connect to the server using SSH both using public key and password authentication. For some reason they are not able to connect using sftp. I'l not sure what's going on. I ran sshd in debug mode and here's... (6 Replies)
Discussion started by: emildiego
6 Replies

7. AIX

AIX audit users activity

Is there a tool or application the will audit users activity? I've tryed to use audit the comes with AIX but to gathers so much information it is near impossible to see what they are doing. I just want to monitor logins and and files they create or change. (9 Replies)
Discussion started by: daveisme
9 Replies

8. Shell Programming and Scripting

Bourne Shell script - log for users loggin on and off

Hello all, I'm new to shell scripting and want to make a script that I can write to log the users logging on and off the a unix system. I have had a good look over the past few days to crack it, I think I am getting close. I want a script that runs an infinite loop to check every 5 seconds... (14 Replies)
Discussion started by: noodlesoup
14 Replies

9. SCO

Commands for review users activity

:D Hi, I'm searching for a command or commands to see the user and programs activity and who much resources is in use. In Unix I remember a TOP command but in SCO I'm don't find a similar. My system is a UNIX SCO 5.6 Thank's (1 Reply)
Discussion started by: DigitalExecutiv
1 Replies

10. UNIX for Dummies Questions & Answers

logging users activity

Hello All! Does anyone know of a nice way to log commands in solaris 8. What I need is a program or script that saves any command that a user does in solaris command prompt. So when Steven logs in on a system, it should record everything he does, from an ls to exit with timestamps. I've been... (6 Replies)
Discussion started by: dozy
6 Replies

Featured Tech Videos