11

I want to remove any and all activity logs for SSH remotely. How do I get to it?

My account on the remote server doesn't have admin privilege, and as such I just want to remove user to user connection records.

5
  • 26
    This sounds suspicious. :) Aug 18, 2011 at 12:28
  • 1
    @Richard, sure it does, but what sounds more suspicious is deleting everything as opposed to just deleting the current session's data.
    – Oxwivi
    Aug 18, 2011 at 14:33
  • 1
    regarding update: not going to happen. If the admin is worth his salt all logs are world-readable but not editable by any one other than the admin (ie. root or sudo permissions required).
    – Rinzwind
    Aug 18, 2011 at 14:45
  • @Rinzwind, nothing is saved in the user directory itself? In the .ssh directory or something, for example.
    – Oxwivi
    Aug 18, 2011 at 14:47
  • 3
    The commands you issued when you have access will be in your bash history file. That's about all I can think of.
    – Rinzwind
    Aug 18, 2011 at 14:53

2 Answers 2

20

The answer to this lies in sshd.conf and sshd_config (server) and ssh_config (client). Depending on the log level it logs to /var/log/syslog (default) and/or /var/log/auth.log (loglevel 'verbose' contains ssh login attempts).

If present /var/log/secure also contains an access log.

You will need root/sudo access to edit any of these files: they will be word-readable but not world-editable.

Next to that. Besides the login from the ssh daemon the command last also shows (failed) logins from ssh. The information for this command comes from /var/log/wtmp (There will be several more I bet).

And there is also the probability the sysadmin installed auditd or logwatch making it practically impossible to hide activity since they could get a notice based on activity undoing the registration of the ssh activity impossible.

Example of /var/log/auth.log:

Aug 10 10:10:10 rinzwind sshd[3653]: Invalid user text from {ipadress}
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp
Aug 10 10:10:10 rinzwind sshd[3653]: error: Could not get shadow information for NOUSER
Aug 10 10:10:10 rinzwind sshd[3653]: Failed password for invalid user test from {ipadress} port {port} ssh2
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp
3
  • Updated question.
    – Oxwivi
    Aug 18, 2011 at 14:43
  • By the way, just what kind of data is logged when SSH connection takes place? IP address for sure, but what else?
    – Oxwivi
    Aug 18, 2011 at 14:44
  • No username recorded?
    – Oxwivi
    Aug 18, 2011 at 15:29
1

You would want to look at /var/log/messages and/or /var/log/syslog.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .