<br><br><div class="gmail_quote">On 27 May 2011 11:59, Colin McCarthy <span dir="ltr"><<a href="mailto:binarysignal@gmail.com">binarysignal@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi all, especially server peoples :)<div><br></div><div>I need to audit SSH sessions against a specific account. This account is used by a company that is connected to our network via a VPN. I need to know how many times, when and for how long, they login within a 30 day period.</div>
<div><br></div></blockquote><div><br></div><div>Check the man page for your ssh daemon and the centos configuration. apparently SSH can log to /var/log/system</div><div>Try thease commands to comb your log directory:</div>
<div>grep -ir ssh /var/log/*</div><div>grep -ir breakin /var/log/*</div><div>grep -ir security /var/log/*</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>The server is running CentOS. I've looked in the /var/log/audit/audit.log* files and I can see my logon attempts but none of theirs. This is assuming they have actually connected at some point. The log files are not easy for me to read....any idea where date and time is stored :) Is it in some strange Unix value of seconds since 1901? :)</div>
</blockquote><div><br></div><div>Info on timestamp & an online converter:</div><div><a href="http://www.unixtimestamp.com/index.php">http://www.unixtimestamp.com/index.php</a></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><br></div><div>Also how can I make sure our logs record 30 days worth of records. Or can I script something specifically to watch out for and record that account?</div><div><br></div></blockquote><div><br></div><div>
You might be able to do this in the SSH configuration, if not then cron a job to copy out the log each night and rename it to "ssh-log-$(date +%F).txt" </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div></div><div>Thanks</div><div><br></div>
<div>See you all tomorrow</div><div><br></div><font color="#888888"><div>Colin</div>
</font><br>_______________________________________________<br>
Kent mailing list<br>
<a href="mailto:Kent@mailman.lug.org.uk">Kent@mailman.lug.org.uk</a><br>
<a href="https://mailman.lug.org.uk/mailman/listinfo/kent" target="_blank">https://mailman.lug.org.uk/mailman/listinfo/kent</a><br></blockquote></div><br>