Re: SSH / SFTP client log -- MIDRANGE-L

we have our ftpID's setup in a header/detail table fashion - host info in
header and get/put file info in the detail.
the log output file is also defined at the header level (host server).

so every time that ftpID is executed (for a single host), the log details
are stored in the log file in an appending fashion.

for any sftp request it always attempts an ssh auth (first) and on
failure reverts to password auth.
yes the details of both are in the log.

method...
addenvvar envvar(qibm_qsh_cmd_output) +
value(&ifslogval) replace(*yes)
spawn sftp -vvv -oport=xxxx xxxxxx@xxxxxxx

the generated log then gets appended to our history log archive for that
server.

Jay

On Mon, Oct 14, 2019 at 8:47 AM Steinmetz, Paul via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

Jay,

Do you have a separate log file for every unique connection or one log
file for all connections.
This is something I was also thinking of incorporating.
I'd like to log the key, ciphers, MACS, KexAlgorithms negotiated.
We also have many using expect, so logging that info would be useful.

Do you have an SSH/SFT server connections?
Are you logging them?
If so, which method?

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Jay
Vaughn
Sent: Sunday, October 13, 2019 3:41 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: SSH / SFTP client log

On the system I built, I chose the -vvv method with details to a file.

The process will append any new connection details to the end of the file,
but I generate a time stamp header so searching is simple.

I further enhanced this process by creating a method of detecting ANY
“keyword phrase” from the last log entry to determine if there were any
errors in the transfer.
I have a user maintained table that contains error keyword phrase, error
explanation, and suggested resolution. I then developed a procedure to
cross reference any error keyword phrase from that log to the table to link
the “plain English” verbiage of the failure to be emailed to our product
support on any failure.

Probably more than you wanted to hear but it’s been working great with
this “built in, error definition” process.

Remote ip, user, ssh and password auth (if using expect) are also included
in the transfer details.

Jay

Sent from my iPhone

On Oct 11, 2019, at 4:38 PM, Steinmetz, Paul via MIDRANGE-L <

midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

I decided on method 3.
Created a WRKWCH, looking at joblogs, comparison data "QSH

CMD('/QOpenSys/bin/sftp"

I now have a real time, SSH/SFTP monitor, which also writes to a

SSH/SFTP log file.

I will be adding another comparison data for FTP.
Info captured thus far, will be adding more.

Job name
Job user
Job number
Job date
Job time
Program name
Location and name of SSH/SFTP script.
SSH/SFTP remote URL

Paul

-----Original Message-----
From: Steinmetz, Paul
Sent: Monday, October 07, 2019 4:30 PM
To: 'Midrange Systems Technical Discussion'
<midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: SSH / SFTP client log

I'm trying to capture and document all SSH /SFTP connections.
Majority, the Power I is the client, so we are either putting or getting

files from 3rd party remotes.

TRCCNN on port 22 is one ugly method, needs a lot of massaging.

A second method could be a scan of all joblogs searching for: "4900 -

QSH CMD('/QOpenSys/bin/sftp"

A third method could be WRKWCH - comparison data "4900 - QSH

CMD('/QOpenSys/bin/sftp"

Problem with methods 2 and 3, It would only have Job, date, time, no

specific SSH/SFTP credentials.

A fourth method would be to add -vvv (verbose trace) to all SSH configs,

then dump the output to a file, then filter out what is needed, possible
but ugly like method 1.

Is there another cleaner method, that might include Remote IP, SSH/SFTP

user, Open SSH details, etc ?

Thank You
_____
Paul Steinmetz
IBM i Systems Administrator

Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071

610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home

psteinmetz@xxxxxxxxxx
http://www.pencor.com/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related

questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com