{"id":18587,"date":"2014-11-07T06:39:15","date_gmt":"2014-11-06T22:39:15","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/11\/07\/archlinux-%e7%9a%84%e7%b3%bb%e7%b5%b1-ssh-log-%e6%aa%94\/"},"modified":"2021-03-18T17:24:10","modified_gmt":"2021-03-18T09:24:10","slug":"archlinux-%e7%9a%84%e7%b3%bb%e7%b5%b1-ssh-log-%e6%aa%94","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/11\/07\/archlinux-%e7%9a%84%e7%b3%bb%e7%b5%b1-ssh-log-%e6%aa%94\/","title":{"rendered":"ArchLinux \u7684\u7cfb\u7d71 ssh log \u6a94"},"content":{"rendered":"

\u4f7f\u7528 ArchLinux\u00a0\u6642\uff0c\u89ba\u5f97\u6709\u4e9b\u5947\u602a\uff0c\u56e0\u70ba\u5728\u4f7f\u7528 Linux\u00a0\u6642\uff0c\u7d93\u5e38\u8981\u67e5\u8a62\u4e00\u4e9b\u7cfb\u7d71\u7684 log\u00a0\u6a94\uff0c\u90fd\u6703\u5230 \/var\/log\u00a0\u76ee\u9304\u4e4b\u4e0b\u641c\u5c0b\uff0c\u4e0d\u904e ArchLinux\u00a0\u7684 \/var\/log\u00a0\u5be6\u5728\u662f\u6709\u4e9b\u7c21\u6f54\u3002
# ls -l \/var\/log<\/span>
total 104<\/span>
-rw——-\u00a0 1 root\u00a0 utmp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1920 Sep 30 22:26 btmp<\/span>
-rw——-\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1068 Sep 30 22:30 fail2ban.log<\/span>
-rw——-\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 984 Sep 30 22:30 faillog<\/span>
drwxr-sr-x+ 4 root\u00a0 systemd-journal\u00a0 4096 Sep 29 23:22 journal<\/span>
-rw-r–r–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 11972 Sep 30 22:30 lastlog<\/span>
-rw-r–r–\u00a0 1 named named\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0 Sep 29 23:41 named.log<\/span>
drwxr-xr-x\u00a0 2 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4096 Jun\u00a0 4\u00a0 2013 old<\/span>
-rw-r–r–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10229 Sep 30 22:38 pacman.log<\/span>
-rw-rw-r–\u00a0 1 root\u00a0 utmp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 53760 Sep 30 22:30 wtmp<\/span>[@more@]\u6bd4\u5982\uff0c\u60f3\u8981\u67e5\u8a62\u4e00\u4e0b\uff0c\u7d93\u7531 ssh\u00a0\u5617\u8a66\u932f\u8aa4\u767b\u9304\u7684\u8a18\u9304\uff0c\u7adf\u7136\u90fd\u627e\u4e0d\u5230\uff0c\u4e00\u822c\u4f86\u8aaa\uff0c\u5927\u6982\u662f
\/var\/log\/secure<\/span>
\u6216\u662f
\/var\/log\/auth.log<\/span><\/p>\n

\u5f8c\u4f86\u4f7f\u7528 Google \u67e5\u8a62\u4e86\u4e00\u4e0b
arch linux – Where are my sshd logs? – Unix & Linux Stack Exchange<\/a><\/p>\n

\u539f\u4f86\u662f\u53ef\u4ee5\u7528\u4e0b\u9762\u7684\u6307\u4ee4\u4f86\u64f7\u53d6\u95dc\u65bc ssh\u00a0\u7684 log
# journalctl -u sshd |tail -10<\/span>
Sep 30 22:26:40 alarmpi sshd[308]: Failed password for root from 192.168.1.6 port 3192 ssh2<\/span>
Sep 30 22:27:55 alarmpi sshd[308]: Connection closed by 192.168.1.6 [preauth]<\/span>
Sep 30 22:27:55 alarmpi sshd[308]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.6\u00a0 user=root<\/span>
Sep 30 22:27:55 alarmpi sshd[308]: PAM service(sshd) ignoring max retries; 4 > 3<\/span>
Sep 30 22:28:25 alarmpi systemd[1]: Stopping OpenSSH Daemon…<\/span>
Sep 30 22:28:26 alarmpi systemd[1]: Stopped OpenSSH Daemon.<\/span>
— Reboot —<\/span>
Jan 01 08:00:16 alarmpi sshd[115]: Server listening on 0.0.0.0 port 22.<\/span>
Sep 30 22:30:12 alarmpi sshd[265]: Accepted password for root from 192.168.1.6 port 3269 ssh2<\/span>
Sep 30 22:30:12 alarmpi sshd[265]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span><\/p>\n

\u5728\u540c\u4e00\u7bc7\u6587\u7ae0\u4e2d\u4e5f\u63d0\u5230\uff0c\u53ef\u4ee5\u5728 \/etc\/syslog.conf \u6216 \/etc\/rsyslog.conf\u00a0\u4e2d\u8a2d\u5b9a\uff0c\u628a\u8a18\u9304\u6a94\u55ae\u7368\u64f7\u53d6\u51fa\u4f86<\/span>
\u5b89\u88dd rsyslog\u00a0\u5957\u4ef6
# pacman -S syslog-ng<\/span>
# sed -i ‘s\/#ForwardToSyslog=no\/ForwardToSyslog=yes\/’ \/etc\/systemd\/journald.conf<\/span><\/p>\n

\u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5 syslog-ng \u670d\u52d9
# systemctl enable syslog-ng<\/span>
Created symlink from \/etc\/systemd\/system\/syslog.service to \/usr\/lib\/systemd\/system\/syslog-ng.service.<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/syslog-ng.service to \/usr\/lib\/systemd\/system\/syslog-ng.service.<\/span><\/p>\n

\u555f\u52d5 syslog-ng \u670d\u52d9
# systemctl start syslog-ng<\/span><\/p>\n

\u6aa2\u67e5 \/var\/log<\/span>\u00a0\u76ee\u9304\u4e0b\u7684 log\u00a0\u6a94
# ls -l \/var\/log<\/span>
total 824<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1245 Oct\u00a0 1 20:17 auth.log<\/span>
-rw——-\u00a0 1 root\u00a0 utmp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2688 Oct\u00a0 1 20:17 btmp<\/span>
-rw——-\u00a0 1 root\u00a0 utmp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6912 Sep 30 23:29 btmp.1<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10952 Oct\u00a0 1 20:16 daemon.log<\/span>
-rw-r—–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 8000 Jan\u00a0 1\u00a0 1970 debug<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 11910 Oct\u00a0 1 20:16 everything.log<\/span>
-rw——-\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4342 Oct\u00a0 1 20:16 fail2ban.log<\/span>
-rw——-\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 984 Oct\u00a0 1 20:17 faillog<\/span>
drwxr-sr-x+ 4 root\u00a0 systemd-journal\u00a0\u00a0 4096 Sep 29 23:22 journal<\/span>
-rw-r—–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 206836 Jan\u00a0 1\u00a0 1970 kern.log<\/span>
-rw-r–r–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 11972 Oct\u00a0 1 20:15 lastlog<\/span>
-rw-r—–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 202786 Oct\u00a0 1 19:49 messages<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10952 Oct\u00a0 1 20:16 messages.log<\/span>
-rw-r–r–\u00a0 1 named named\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0 Sep 29 23:41 named.log<\/span>
drwxr-xr-x\u00a0 2 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4096 Jun\u00a0 4\u00a0 2013 old<\/span>
-rw-r–r–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 12889 Oct\u00a0 1 19:51 pacman.log<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1005 Oct\u00a0 1 20:17 ssh.log<\/span>
-rw-r—–\u00a0 1 root\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 215446 Oct\u00a0 1 19:49 syslog<\/span>
-rw-r—–\u00a0 1 root\u00a0 log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 958 Jan\u00a0 1\u00a0 1970 syslog.log<\/span>
-rw-rw-r–\u00a0 1 root\u00a0 utmp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 83712 Oct\u00a0 1 20:15 wtmp<\/span><\/p>\n

ssh log\u00a0\u6a94\u5132\u5b58\u5728 \/var\/log\/auth.log <\/span><\/span>
# cat \/var\/log\/auth.log<\/span><\/span>
Jan\u00a0 1 08:00:15 alarmpi systemd-logind[126]: New seat seat0.<\/span>
Oct\u00a0 1 20:15:55 alarmpi sshd[258]: Accepted password for root from 192.168.1.6 port 2278 ssh2<\/span>
Oct\u00a0 1 20:15:55 alarmpi sshd[258]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span>
Oct\u00a0 1 20:15:55 alarmpi systemd-logind[126]: New session c1 of user root.<\/span>
Oct\u00a0 1 20:15:55 alarmpi systemd: pam_unix(systemd-user:session): session opened for user root by (uid=0)<\/span>
Oct\u00a0 1 20:16:55 alarmpi sshd[275]: Address 192.168.1.10 maps to tces-doc-airport-express.home, but this does not map back to the address – POSSIBLE BREAK-IN ATTEMPT!<\/span>
Oct\u00a0 1 20:16:57 alarmpi sshd[275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.10\u00a0 user=root<\/span>
Oct\u00a0 1 20:16:58 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:01 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: Connection closed by 192.168.1.10 [preauth]<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.10\u00a0 user=root<\/span><\/p>\n

\u4e5f\u53ef\u4ee5\u55ae\u7368\u628a ssh\u00a0\u7684 log\u00a0\u6a94\u62bd\u96e2\u51fa\u4f86
\u4fee\u6539 \/etc\/syslog-ng\/syslog-ng.conf<\/span>
# vim \/etc\/syslog-ng\/syslog-ng.conf<\/span>
#sshd configuration<\/span>
\u52a0\u5165\u4e0b\u9762\u4e09\u884c\u8a2d\u5b9a<\/span>
destination ssh { file(“\/var\/log\/ssh.log”); };<\/span>
filter f_ssh { program(“sshd”); };<\/span>
log { source(src); filter(f_ssh); destination(ssh); };<\/span><\/p>\n

\u91cd\u65b0\u555f\u52d5 syslog-ng \u670d\u52d9
# systemctl restart syslog-ng<\/span><\/p>\n

\u53ea\u5269\u4e0b\u548c ssh\u00a0\u76f8\u95dc\u7684 log
# cat \/var\/log\/ssh.log<\/span>
Oct\u00a0 1 20:15:55 alarmpi sshd[258]: Accepted password for root from 192.168.1.6 port 2278 ssh2<\/span>
Oct\u00a0 1 20:15:55 alarmpi sshd[258]: pam_unix(sshd:session): session opened for user root by (uid=0)<\/span>
Oct\u00a0 1 20:16:55 alarmpi sshd[275]: Address 192.168.1.10 maps to tces-doc-airport-express.home, but this does not map back to the address – POSSIBLE BREAK-IN ATTEMPT!<\/span>
Oct\u00a0 1 20:16:57 alarmpi sshd[275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.10\u00a0 user=root<\/span>
Oct\u00a0 1 20:16:58 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:01 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: Failed password for root from 192.168.1.10 port 59403 ssh2<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: Connection closed by 192.168.1.10 [preauth]<\/span>
Oct\u00a0 1 20:17:04 alarmpi sshd[275]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.10\u00a0 user=root<\/span><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4f7f\u7528 ArchLinux\u00a0\u6642\uff0c\u89ba\u5f97\u6709\u4e9b\u5947\u602a\uff0c\u56e0\u70ba\u5728\u4f7f\u7528 Linux\u00a0\u6642\uff0c\u7d93\u5e38\u8981\u67e5\u8a62\u4e00\u4e9b\u7cfb\u7d71\u7684 log\u00a0\u6a94\uff0c\u90fd\u6703 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008ArchLinux \u7684\u7cfb\u7d71 ssh log \u6a94\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[167],"tags":[],"class_list":["post-18587","post","type-post","status-publish","format-standard","hentry","category-c-84386"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["520666"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18587"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18587"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18587\/revisions"}],"predecessor-version":[{"id":20214,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18587\/revisions\/20214"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}