ssh 로그인 로그 설정

1. syslog.conf 설정

# vi /etc/syslog.conf

#ident  "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */

#

# Copyright (c) 1991-1998 by Sun Microsystems, Inc.

# All rights reserved.

#

# syslog configuration file.

#

# This file is processed by m4 so be careful to quote (`') names

# that match m4 reserved words.  Also, within ifdef's, arguments

# containing commas must be quoted.

#

*.err;kern.notice;auth.notice                   /dev/sysmsg

*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

*.alert;kern.err;daemon.err                     operator

*.alert                                         root

*.emerg                                         *

# if a non-loghost machine chooses to have authentication messages

# sent to the loghost machine, un-comment out the following line:

#auth.notice                    ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)

#

# non-loghost machines will use the following lines to cause "user"

# log messages to be logged locally.

#

ifdef(`LOGHOST', ,

user.err                                        /dev/sysmsg

user.err                                        /var/adm/messages

user.alert                                      `root, operator'

user.emerg                                      *

)

# FJSVmadm : This is setting of the Machine Administration.

# FJSVmadm : Don't delete the following lines.

# FJSVmadm : Because the message cannot be observed.

*.err;kern.debug;daemon.notice                  /var/opt/FJSVmadm/evh/evh_pipe

#ssh log

auth.info       /var/log/authlog

auth.info (tab) /var/log/authlog 설정

2. /etc/ssh/sshd_config 파일에서 facility, level 확인

....

# Syslog facility and level

SyslogFacility auth

LogLevel info

.......

3. syslog service 재시작 

# svcadm restart svc:/system/system-log:default

4. cat /var/log/authlog 에서 로그내용 확인 ( telnet, ssh 접속 둘다 확인 )

....

Jul 20 10:06:39 test last message repeated 1 time

Jul 20 10:06:39 test sshd[3000]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 192.168.21.89 port 59561 ssh2

Jul 20 10:06:40 test sshd[3000]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: 인증 실패

Jul 20 10:06:40 test sshd[3000]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 192.168.21.89 port 59561 ssh2

Jul 20 10:06:40 test sshd[3000]: [ID 800047 auth.info] Connection closed by 192.168.21.89

Jul 20 10:06:40 test last message repeated 1 time

Jul 20 10:08:27 test sshd[3036]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: 인증 실패

Jul 20 10:08:35 test last message repeated 1 time

Jul 20 10:08:35 test sshd[3036]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 192.168.21.89 port 59563 ssh2

Jul 20 10:08:45 test sshd[3036]: [ID 800047 auth.info] Accepted keyboard-interactive for root from 192.168.21.89 port 59563 ssh2

....

로그인 성공, 실패들을 확인할 수 있다.