Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity on my servers? Is it SELinux through /var/log/audit/audit.log?

share|improve this question
add comment

2 Answers

You need to adjust your sshd logging level.

Look at the /etc/ssh/sshd_config for the "LogLevel" directive.

Or the scp -o LogLevel for testing.

share|improve this answer
add comment

SCP uses SSH connections to transfer files, so SCP logins should appear in the same logs alongside SSH logins. From the man pages:

scp copies files between hosts on a network. It uses ssh(1) for data transfer, and uses the same authentication and provides the same security as ssh(1).

share|improve this answer
    
I know it uses SSH and I thought logs would also go to the same place, but it actually doesn't show up in /var/log/secure nor /var/log/messages. The only evidence of SCP is when I have SELinux and auditd running... in which case it gets logged in /var/log/audit/audit.log. –  JJC May 9 '12 at 11:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.