Hi Paul,
Perhaps security audit journals might help?
SK (Sockets Connections) journal entries appear to record information for SSH connections, amongst others. The journal entry layout is defined here:
https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_74/rzarl/rzarlf57.htm
The column "Secure Version" identifies SSH as a possible value.
Not much, but maybe a starting point for you.
Best wishes,
Richard
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Steinmetz, Paul via MIDRANGE-L
Sent: 07 October 2019 21:30
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
Subject: SSH / SFTP client log
I'm trying to capture and document all SSH /SFTP connections.
Majority, the Power I is the client, so we are either putting or getting files from 3rd party remotes.
TRCCNN on port 22 is one ugly method, needs a lot of massaging.
A second method could be a scan of all joblogs searching for: "4900 - QSH CMD('/QOpenSys/bin/sftp"
A third method could be WRKWCH - comparison data "4900 - QSH CMD('/QOpenSys/bin/sftp"
Problem with methods 2 and 3, It would only have Job, date, time, no specific SSH/SFTP credentials.
A fourth method would be to add -vvv (verbose trace) to all SSH configs, then dump the output to a file, then filter out what is needed, possible but ugly like method 1.
Is there another cleaner method, that might include Remote IP, SSH/SFTP user, Open SSH details, etc ?
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx
http://www.pencor.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
