Fix /var/log/auth.log Not Logging Failed SSH Attempts

authenticationloggingssh

I'm trying to go failed (either incorrect username, password, or both) on my server.

I changed /etc/ssh/sshd_config from

# Logging
SyslogFacility AUTH 
LogLevel INFO

to

# Logging
SyslogFacility AUTH 
LogLevel VERBOSE

and have since tried multiple ssh attempts with both existing and non-exisiting users with random passwords thus failing. When checking /var/log/auth.log nothing appears and it is entirely blank.

What am I missing? Does some other process need to also be install and running on my system? I'm running Ubuntu.

Any help or guidance on this matter is more than welcome.

Thanks

Best Answer

The LogLevel generally (apparently application dependent) refers to one of the defined severity levels supported by the system logging process (syslog). So change it back and restart the sshd server.

Now if you are not getting the output, you need to look at the system /etc/syslog.conf and see what MINIMUM loglevel the AUTH type of requests are being logged and to what file. The errors might be going to a different log file. OR you might not be logging these errors due to the syslog.conf configuration for the AUTH service. For more information consult the man pages on and syslog.conf.

Related Topic