I work in college network. I have shared my computer password with few friends. So any of them can ssh/ scp on my system. Is there any way to generate the log of connection ( if some one make connection through ssh or copying using scp ) data. ( Just in case to see what they do on my system ) ? I am using openssh-server in ubuntu 10.10 system.
It seems to me that we can generate log or can get notification for ssh connection ( by looking SSH_CONNECTION parameter ) but no way for scp, or is there any ?

EDIT: I little bit of solution : create a rc file inside .ssh directory and create log from that rc file.

  • Not an answer, but it's more secure to give them a ssh key and disable password-based access. Mar 13, 2012 at 21:18
  • give them ssh-key or take their ssh-key ?
    – Peeyush
    Mar 14, 2012 at 11:16
  • If they've got an ssh-key, go ahead and use that. If they don't already have one, generate one for them. Mar 14, 2012 at 13:02

2 Answers 2

  1. type the command 'last' on your $-prompt
  2. check the log-files: /var/log/auth.log
  3. you shouldn't give your own password away, it is better to create an account for sharing data. Make a separate account per user and place them in the same group (GID) that way you can easily share files and the like, without them being able to sniff around too much.
  • thing is : working in same organization, generally friends know the password of computers. So it's not about giving password-less/separate account access.
    – Peeyush
    Mar 14, 2012 at 11:15

By default, the OpenSSH server logs to the AUTH facility of syslog, at the INFO level. If you want to record more information - such as failed login attempts - you should increase the logging level to VERBOSE.

It's recommended to log more information if you're curious about malicious SSH traffic.

To increase the level, find the following line in your sshd_config:

LogLevel INFO and change it to this:

LogLevel VERBOSE Now all the details of ssh login attempts will be saved in your /var/log/auth.log file.

More info at: https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

  • nice piece of information. But no luck for scp, though scp also leaves some trace as ssh in auth.log, but I was wondering is there any way to know which files/directories are being copied.
    – Peeyush
    Mar 13, 2012 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.