Centos – Access logs of sftp on centos

centoscentos6ftplogging

Is it possible to log the sftp logged in informations (Who accessed, when and from where )

Like which sftp user have logged on to the file server , This may also contain information such as ip address of the user.

The log may also give info such as directories accessed, and at last the commands executed.

I do have a dedicated centos server, of which root access is shared. So it is very important for me to track it.

If there is already a log file, may i know where on centos i can find it.

Thanks

Best Answer

SFTP as already mentioned works over ssh(port 22). So it's actual ssh users and you have to check corresponding logs.

It should be log: /var/log/secure if it's not rewritten by your actual rsyslog configuration.

Related Solutions

Ftp – vsftpd: access SFTP on local user without shell access with specific directory

Sorry but it looks like you are confusing the protocols. I.e. SFTP and FTPS. SFTP is for SSH FTPS is used for and by the FTP server.

If you really want to lock the user down. Add /usr/sbin/nologin /etc/shells (this will stop SSH access) Add your user 'max' to /etc/vsftpd/chroot_list

Configure your filezilla to use FTPS

OpenSSH – Logging Public Key Used in Authentication

If you raise the LogLevel to VERBOSE in your configuration file (/etc/sshd/sshd_config or similar) it will log the fingerprint of the public key used to authenticate the user.

LogLevel VERBOSE

Then you get messages like this:

Jul 19 11:23:13 centos sshd[13431]: Connection from 192.168.1.104 port 63529
Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: 54:a2:0a:cf:85:ef:89:96:3c:a8:93:c7:a1:30:c2:8b
Jul 19 11:23:13 centos sshd[13432]: Postponed publickey for user from 192.168.1.104 port 63529 ssh2
Jul 19 11:23:13 centos sshd[13431]: Found matching RSA key: 54:a2:0a:cf:85:ef:89:96:3c:a8:93:c7:a1:30:c2:8b
Jul 19 11:23:13 centos sshd[13431]: Accepted publickey for user from 192.168.1.104 port 63529 ssh2

You can use:

 ssh-keygen -lf /path/to/public_key_file

to get the fingerprint of a particular public key.

Best Answer

Related Solutions

Ftp – vsftpd: access SFTP on local user without shell access with specific directory

OpenSSH – Logging Public Key Used in Authentication

Related Topic