ssh logs?

[Red Squirrel]

Where can I find ssh logs in linux? I want to be able to see stuff like:

[10.1.1.20] date - user - failed login
[10.1.1.20] date - user - failed login
[10.1.1.20] date - user - logging accepted
[10.1.1.20] date - user - su password for root accepted
[10.1.1.20] date - root - logged off


Or something along those lines. I want to know exactly who logs on as what user, from what Ip, and when. And I'd like to know if there's any ways to lock out IPs that have 3 failed login attempts (and perhaps even send me an email alert).

 

[n0cmonkey]

Originally posted by: RedSquirrel
Where can I find ssh logs in linux? I want to be able to see stuff like:

[10.1.1.20] date - user - failed login
[10.1.1.20] date - user - failed login
[10.1.1.20] date - user - logging accepted
[10.1.1.20] date - user - su password for root accepted
[10.1.1.20] date - root - logged off


Or something along those lines. I want to know exactly who logs on as what user, from what Ip, and when. And I'd like to know if there's any ways to lock out IPs that have 3 failed login attempts (and perhaps even send me an email alert).

It depends on how syslogd is setup probably. On OpenBSD it's in /var/log/authlog, but I think it's in /var/log/messages on RHES. It should give you the IP the connection is coming from.

You could probably setup swatch to ban the IPs from 3 failed attempts with a little bit of scripting work.