View the configuration file for rsyslog, find the RULES section, and
find the line dealing with the authpriv facility (the line that starts
with the word authpriv). Put this line into
rsyslog_authpriv.txt in your sysadmin base directory:
$ wc rsyslog_authpriv.txt
1 2 72 rsyslog_authpriv.txt
$ sum rsyslog_authpriv.txt
42327 1
View the configuration file for the SSH service daemon sshd named
/etc/ssh/sshd_config (note the d in sshd) and find the Logging
section. Copy the one active Logging configuration line (it starts
with the word SyslogFacility) into the file sshd_logging.txt
in your sysadmin base directory:
$ wc sshd_logging.txt
1 2 24 sshd_logging.txt
$ sum sshd_logging.txt
50989 1
Remember the name of this sshd configuration file and the location
of this rsyslog line. You will need to edit it, below.
Notice the correspondence between the contents of
rsyslog_authpriv.txt and sshd_logging.txt and determine the file
that sshd log entries are added to. They both use the same logging
keyword (though one is using it upper-case, which doesn’t matter).
Start a separate window (console, or PuTTY, or ssh) and use the
tail -f command with sudo to watch the file that sshd log
entries go to.
- The
-f option keeps watch on the end of the file, waiting for
new lines to appear.
- The last line of the file should show a log entry for the
sudo command you just used.
In another window, log in again to your CentOS VM with ssh or
PuTTY, and observe the output of your tail -f command in the
other window.
- You should see
sshd log entries for your login activity.
Still in the same ssh / PuTTY window from the last step, use the sudo
command to run head on the /etc/shadow file. The use of sudo
will cause log entries for sudo in the same file on which you’re
running the tail -f command. (Now you know to which log facility,
and therefore in which log file, sudo invocations get logged!)
Interrupt the tail -f with ^C and then put the last 20 lines of that
log file into ssh_sudo_log.txt in your sysadmin base directory.
- View this file to be sure it includes both the
sshd and
sudo log entries you saw in the previous steps.
- If the file doesn’t contain those log entries, then redirect a
tail -f
of the log file to ssh_sudo_log.txt, and repeat the ssh and sudo
steps to be sure the logging output goes into ssh_sudo_log.txt
- The
ssh_sudo_log.txt file must show logging lines from both
ssh and from sudo.
Recall the name of the sshd configuration file viewed earlier.
- Back up and edit that file to make the SSH service daemon switch
from using the
AUTHPRIV to the AUTH logging facility by uncommenting one line
and commenting out another. (Both lines exist in the file already.)
- When you’re done, the
wc on the file should be the same.
Run a diff between the old and new files to confirm your change.
- Save a copy of the edited file in file
sshd_new.txt in your sysadmin base directory.
Restart the sshd service using the appropriate command.
- You should see
Stopping sshd: [OK] followed by Starting sshd: [OK].
Read the Hints below. View the rsyslog config file and put the
line of the rule that controls the auth facility into
rsyslog_auth.txt in your sysadmin base directory:
$ wc rsyslog_auth.txt
1 2 74 rsyslog_auth.txt
$ sum rsyslog_auth.txt
06250 1
Hint: There is no line that explicitly matches the auth
facility. Look for a “catch-all” or “log anything” rule instead.
Similarly to how you monitored sshd activity before, run tail -f
on the log file corresponding to the auth facility (a different
log file now), which is now used for sshd logging.
Similarly to before, generate some sshd activity to appear in the
log by using ssh or PuTTY, and confirm that you see a log entry
in the correct log file that you’re monitoring due to the previous step.
Change /etc/ssh/sshd_config back to use the previous log
facility, and restart the sshd service.
