Question on security..
Robert Watson
rwatson at FreeBSD.org
Tue Jan 15 08:18:50 PST 2008
On Tue, 15 Jan 2008, Richard Bates wrote:
> I know login failures are logged in /var/log/auth.log
>
> is there a way to log the login of users in this log say something like
>
> Jan 15 10:59:00 MyServer sshd[91869]: User bates authenticated from
> 172.18.1.139
> Jan 15 10:59:00 MyServer sshd[91869]: User bates Disconnected from
> 172.18.1.139
The normal system lastlog, accessed via last(1), does this fairly well. As
you notch up the level of logging on sshd, it should also be able to do that.
However, I tend to use audit for the above type of functionality, as the
results are more parseable using tools like auditreduce. There's a handbook
chapter on how to configure and use audit, should you be looking for something
a bit more on that scale of things.
Robert N M Watson
Computer Laboratory
University of Cambridge
More information about the freebsd-current
mailing list