× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. October 2019

Re: SSH / SFTP client log

Hi Paul,

I use syslogd , but you need to make some adjustments:

Using a *SECOFR user:

vi /QOpenSys/etc/syslog.conf

Add the following lines:

auth.info /home/syslog/ssh.log
*.emerg;*.alert;*.crit;*.warning;*.err;*.notice /home/syslog/syslog.log
*.info          /home/syslog/info.log

Now create the empty files:

mkdir /home/syslog
chmod 700 /home/syslog
touch /home/syslog/syslog.log
touch /home/syslog/ssh.log
touch /home/syslog/info.log

Start "syslogd"

syslogd

Now we need to restart *SSHD

ENDTCSVR *SSHD
STRTCPSVR *SSHD

You can see access in real time using ssh to get a shell and put:

tail -f /home/syslog/ssh.log

You will see something like this:

Oct  8 21:16:02 IBMI01 auth|security:info sshd[3494]: Accepted publickey for dkesselman from 192.168.0.123 port 39234 ssh2: RSA SHA256:X/QU+...(private data)
Oct  8 21:18:48 IBMI01 auth|security:info sshd[3494]: Received disconnect from 192.168.0.123: 11: disconnected by user
Oct  8 21:18:48 IBMI01 auth|security:info sshd[3494]: Disconnected from 192.168.0.123
Oct  8 21:24:12 IBMI01 auth|security:info sshd[3511]: Accepted publickey for dkesselman from 192.168.0.123 port 39284 ssh2: RSA SHA256:X/QU+... (private data)
Oct  8 21:29:16 IBMI01 auth|security:info sshd[3511]: Received disconnect from 192.168.0.123: 11: disconnected by user
Oct  8 21:29:16 IBMI01 auth|security:info sshd[3511]: Disconnected from 192.168.0.123
Oct  8 21:37:52 IBMI01 auth|security:info sshd[4057]: Accepted publickey for dkesselman from 192.168.0.123 port 39472 ssh2: RSA SHA256:X/QU+...(private data)


This will log SSH connections. Now you can log SFTP access using this:

# Original
Subsystem       sftp /QOpenSys/QIBM/ProdData/SC1/OpenSSH/openssh-4.7p1/libexec/sftp-server


#New Line
Subsystem       sftp /QOpenSys/QIBM/ProdData/SC1/OpenSSH/openssh-4.7p1/libexec/sftp-server -f AUTH -l verbose

NOTE: These lines are on V7R1. You need to adjust directories on V7R2 and higher.

If you understand spanish I've writen articles on SSH and SFTP logging:

IBM i : Siguiendo la huella de las conexiones SFTP
http://bit.ly/2nPIxjU

IBM i: Siguiendo el rastro de las conexiones por SSH
http://bit.ly/2OO4f2A

Regards,

Diego E. KESSELMAN


El 14/10/19 a las 7:46, Steinmetz, Paul via MIDRANGE-L escribió:
Jay,

Do you have a separate log file for every unique connection or one log file for all connections.
This is something I was also thinking of incorporating.
I'd like to log the key, ciphers, MACS, KexAlgorithms negotiated.
We also have many using expect, so logging that info would be useful.

Do you have an SSH/SFT server connections?
Are you logging them?
If so, which method?

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Jay Vaughn
Sent: Sunday, October 13, 2019 3:41 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: SSH / SFTP client log

On the system I built, I chose the -vvv method with details to a file.

The process will append any new connection details to the end of the file, but I generate a time stamp header so searching is simple.

I further enhanced this process by creating a method of detecting ANY “keyword phrase” from the last log entry to determine if there were any errors in the transfer.
I have a user maintained table that contains error keyword phrase, error explanation, and suggested resolution. I then developed a procedure to cross reference any error keyword phrase from that log to the table to link the “plain English” verbiage of the failure to be emailed to our product support on any failure.

Probably more than you wanted to hear but it’s been working great with this “built in, error definition” process.

Remote ip, user, ssh and password auth (if using expect) are also included in the transfer details.

Jay

Sent from my iPhone

On Oct 11, 2019, at 4:38 PM, Steinmetz, Paul via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

I decided on method 3.
Created a WRKWCH, looking at joblogs, comparison data "QSH CMD('/QOpenSys/bin/sftp"

I now have a real time, SSH/SFTP monitor, which also writes to a SSH/SFTP log file.
I will be adding another comparison data for FTP.
Info captured thus far, will be adding more.

Job name
Job user
Job number
Job date
Job time
Program name
Location and name of SSH/SFTP script.
SSH/SFTP remote URL

Paul



-----Original Message-----
From: Steinmetz, Paul
Sent: Monday, October 07, 2019 4:30 PM
To: 'Midrange Systems Technical Discussion'
<midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: SSH / SFTP client log

I'm trying to capture and document all SSH /SFTP connections.
Majority, the Power I is the client, so we are either putting or getting files from 3rd party remotes.

TRCCNN on port 22 is one ugly method, needs a lot of massaging.

A second method could be a scan of all joblogs searching for: "4900 - QSH CMD('/QOpenSys/bin/sftp"
A third method could be WRKWCH - comparison data "4900 - QSH CMD('/QOpenSys/bin/sftp"

Problem with methods 2 and 3, It would only have Job, date, time, no specific SSH/SFTP credentials.

A fourth method would be to add -vvv (verbose trace) to all SSH configs, then dump the output to a file, then filter out what is needed, possible but ugly like method 1.

Is there another cleaner method, that might include Remote IP, SSH/SFTP user, Open SSH details, etc ?

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com

As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.