Mailing List Archive

On Tue, 1 Dec 2020, Heikki Orsila wrote:

> It seems sftp does not write into wtmp, and

That’s correct; wtmp is for (pseudo?)terminal logins.

bye,
//mirabilos
--
15:41?<Lo-lan-do:#fusionforge> Somebody write a testsuite for helloworld :-)
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

On Tue, Dec 01, 2020 at 06:09:00PM +0200, Heikki Orsila wrote:
> Hello OpenSSH developers and users!
>
> My client uses wtmp information to determine past logins though ssh into
> their production environment. It seems sftp does not write into wtmp, and

You'll also find things like
ssh remotehost /bin/sh -i
also don't write to wtmp.

wtmp is totally unsuitable to be used as a tool to determine past logins.

--

rgds
Stephen
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

Heikki Orsila wrote:
> My client uses wtmp information to determine past logins though ssh into
> their production environment. It seems sftp does not write into wtmp, and
> thus, it is not possible to list past sftp sessions. To make this happen
> I can see several options:
>
> 1. We write a custom tool to analyze auth.log to determine past sessions.
> This is not useful for ssh community in general.

I am scanning the /var/log/auth.log file for this information. That's
where the information is logged.

Bob
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

On Wed, Dec 02, 2020 at 02:08:26PM -0700, Bob Proulx wrote:
> Heikki Orsila wrote:
> > My client uses wtmp information to determine past logins though ssh into
> > their production environment. It seems sftp does not write into wtmp, and
> > thus, it is not possible to list past sftp sessions. To make this happen
> > I can see several options:
> >
> > 1. We write a custom tool to analyze auth.log to determine past sessions.
> > This is not useful for ssh community in general.
>
> I am scanning the /var/log/auth.log file for this information. That's
> where the information is logged.

Do you have this tool available somewhere?

A configuration option to instruct sshd to write to wtmp no matter what
session is in question would be useful.

Is there an objection from the developers to have this kind of option?

--
Heikki Orsila
heikki.orsila@zakalwe.fi
http://www.iki.fi/shd
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

Heikki Orsila wrote:
> Bob Proulx wrote:
> > I am scanning the /var/log/auth.log file for this information. That's
> > where the information is logged.
>
> Do you have this tool available somewhere?

My use is ad-hoc scanning with awk, grep, sed, perl. So not really a
general purpose tool. But the format is simple and not too difficult.

Here is example. This might not be completely correct but it has been
sufficient for my needs. YMMV.

Dec 2 18:58:55 havoc sshd[24031]: Accepted publickey for teaclub from 63.224.80.128 port 44854 ssh2: RSA SHA256:Nab5H8iLOWfU704AhqiYQkiX8T5ADv2a83uCw/vQLL0
Dec 2 18:58:55 havoc sshd[24031]: pam_unix(sshd:session): session opened for user teaclub by (uid=0)

The sshd is recording the process that is now parenting that process
tree. In this case it is 24031. Then that same process is logged
through PAM starting a session. Then later that session is closed.

Dec 2 20:18:26 havoc sshd[24031]: pam_unix(sshd:session): session closed for user teaclub

In my case I am tracking only public key logins. I have a perl script
which reads the log file line by line. It looks for lines that match
the /Accepted publickey for/ pattern. It extracts the sshd pid. It
then reads line looking for that sshd pid looking for the session
open. And then later for the session close. (Note that after the
session is closed the pid may be reused.) The session open and close
information logged there provides the information I needed.

Bob
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

On Thu, Dec 03, 2020 at 01:55:06PM -0700, Bob Proulx wrote:
> Heikki Orsila wrote:
> > Bob Proulx wrote:
> > > I am scanning the /var/log/auth.log file for this information. That's
> > > where the information is logged.
> >
> > Do you have this tool available somewhere?
>
> My use is ad-hoc scanning with awk, grep, sed, perl. So not really a
> general purpose tool. But the format is simple and not too difficult.
>
> Here is example. This might not be completely correct but it has been
> sufficient for my needs. YMMV.
>
> Dec 2 18:58:55 havoc sshd[24031]: Accepted publickey for teaclub from 63.224.80.128 port 44854 ssh2: RSA SHA256:Nab5H8iLOWfU704AhqiYQkiX8T5ADv2a83uCw/vQLL0
> Dec 2 18:58:55 havoc sshd[24031]: pam_unix(sshd:session): session opened for user teaclub by (uid=0)
>
> The sshd is recording the process that is now parenting that process
> tree. In this case it is 24031. Then that same process is logged
> through PAM starting a session. Then later that session is closed.
>
> Dec 2 20:18:26 havoc sshd[24031]: pam_unix(sshd:session): session closed for user teaclub
>
> In my case I am tracking only public key logins. I have a perl script
> which reads the log file line by line. It looks for lines that match
> the /Accepted publickey for/ pattern. It extracts the sshd pid. It
> then reads line looking for that sshd pid looking for the session
> open. And then later for the session close. (Note that after the
> session is closed the pid may be reused.) The session open and close
> information logged there provides the information I needed.

Thanks, Bob! It seems you have implemented the option 1 in the
original question.

- Heikki
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev