Re: SSHD log: How/Where to define -- MIDRANGE-L

Are you looking for something like a syslog? You can set this up on the iSeries to log who connected, etc

http://www-01.ibm.com/support/docview.wss?rs=0&dc=DB520&dc=D900&dc=D800&dc=DA900&dc=DA800&q1=syslog+AND+AS400KBXXYYZZRCH&uid=nas19f4aefa9525b71a4862572f70053ac54&loc=en_US&cs=UTF-8&lang=all

It will show the following

Dec 22 16:38:51 SSHSERVER auth|security:info sshd[35618]: Server listening on 0.0.0.0 port 22.
Dec 22 16:39:10 SSHSERVER auth|security:info sshd[35619]: Failed password for someuser from 1.1.1.1 port 1372 ssh2
Dec 22 16:39:40 SSHSERVER auth|security:info sshd[35619]: Accepted password for someuser from 1.1.1.1 port 1372 ssh2
Dec 22 18:09:49 SSHSERVER auth|security:info sshd[36108]: Accepted publickey for someuser from 1.1.1.2 port 51590 ssh2

-----Original Message-----
From: Zvi Kave <zvi_kave@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Sent: Wed, Aug 4, 2010 10:36 am
Subject: Re: SSHD log: How/Where to define

Hi,

hat article talks about issues with the SSH . For example: There is no exit
oint
or it.
am trying to find a log of SSH traffic to have some control of this tool.
o this article has no solution to this.

egards,

vi

-- On Wed, 8/4/10, jmoreno@xxxxxxxxxxxxxxxx <jmoreno@xxxxxxxxxxxxxxxx> wrote:

rom: jmoreno@xxxxxxxxxxxxxxxx <jmoreno@xxxxxxxxxxxxxxxx>
ubject: Re: SSHD log: How/Where to define
o: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
ate: Wednesday, August 4, 2010, 7:06 AM

ound this
http://osdir.com/ml/systems.as400.security/2006-09/msg00048.html
it may be relevant to what you are trying to do
Hope that helps
Jorge

Zvi Kave <zvi_kave@xxxxxxxxx>
ent by: midrange-l-bounces@xxxxxxxxxxxx
8/04/2010 08:12 AM
lease respond to
idrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>

o
idrange-l@xxxxxxxxxxxx
c
Subject
SHD log: How/Where to define

i all,
I am trying to find where is or how to define log file of SSHD which logs
ll ssh log attempts in my V5R4 machine.
can not find any field in the sshd_config for this purpose.
saw in Linux that log file is /var/log/secure or /var/log/auth.log but
lso there I can not
ind how it was defined.
Regards,
Zvi

-
his is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
ist
o post a message email: MIDRANGE-L@xxxxxxxxxxxx
o subscribe, unsubscribe, or change list options,
isit: http://lists.midrange.com/mailman/listinfo/midrange-l
r email: MIDRANGE-L-request@xxxxxxxxxxxx
efore posting, please take a moment to review the archives
t http://archive.midrange.com/midrange-l.

-
his is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
o post a message email: MIDRANGE-L@xxxxxxxxxxxx
o subscribe, unsubscribe, or change list options,
isit: http://lists.midrange.com/mailman/listinfo/midrange-l
r email: MIDRANGE-L-request@xxxxxxxxxxxx
efore posting, please take a moment to review the archives
t http://archive.midrange.com/midrange-l.

-
his is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
o post a message email: MIDRANGE-L@xxxxxxxxxxxx
o subscribe, unsubscribe, or change list options,
isit: http://lists.midrange.com/mailman/listinfo/midrange-l
r email: MIDRANGE-L-request@xxxxxxxxxxxx
efore posting, please take a moment to review the archives
t http://archive.midrange.com/midrange-l.