Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.


I work in college network. I have shared my computer password with few friends. So any of them can ssh/ scp on my system. Is there any way to generate the log of connection ( if some one make connection through ssh or copying using scp ) data. ( Just in case to see what they do on my system ) ? I am using openssh-server in ubuntu 10.10 system.
It seems to me that we can generate log or can get notification for ssh connection ( by looking SSH_CONNECTION parameter ) but no way for scp, or is there any ?

EDIT: I little bit of solution : create a rc file inside .ssh directory and create log from that rc file.

share|improve this question
    
Not an answer, but it's more secure to give them a ssh key and disable password-based access. –  David Oneill Mar 13 '12 at 21:18
    
give them ssh-key or take their ssh-key ? –  Peeyush Mar 14 '12 at 11:16
    
If they've got an ssh-key, go ahead and use that. If they don't already have one, generate one for them. –  David Oneill Mar 14 '12 at 13:02
add comment

2 Answers 2

up vote 1 down vote accepted

By default, the OpenSSH server logs to the AUTH facility of syslog, at the INFO level. If you want to record more information - such as failed login attempts - you should increase the logging level to VERBOSE.

It's recommended to log more information if you're curious about malicious SSH traffic.

To increase the level, find the following line in your sshd_config:

LogLevel INFO and change it to this:

LogLevel VERBOSE Now all the details of ssh login attempts will be saved in your /var/log/auth.log file.

More info at: https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

share|improve this answer
    
nice piece of information. But no luck for scp, though scp also leaves some trace as ssh in auth.log, but I was wondering is there any way to know which files/directories are being copied. –  Peeyush Mar 13 '12 at 18:36
add comment
  1. type the command 'last' on your $-prompt
  2. check the log-files: /var/log/auth.log
  3. you shouldn't give your own password away, it is better to create an account for sharing data. Make a separate account per user and place them in the same group (GID) that way you can easily share files and the like, without them being able to sniff around too much.
share|improve this answer
    
thing is : working in same organization, generally friends know the password of computers. So it's not about giving password-less/separate account access. –  Peeyush Mar 14 '12 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.