Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity on my servers? Is it SELinux through /var/log/audit/audit.log?

share|improve this question

2 Answers 2

You need to adjust your sshd logging level.

Look at the /etc/ssh/sshd_config for the "LogLevel" directive.

Or the scp -o LogLevel for testing.

share|improve this answer
    
adjust the LogLevel directive to what? Excuse me for saying so, but without this information your answer is pretty much useless. If you know the answer, why don't you say LogLevel=foo ? –  Martin Vegter Jun 10 at 22:20
    
@MartinVegter I didn't make a specific setting suggestion because the OP didn't specify what logging level they were after. I'm sorry that my otherwise correct answer according to the OP (the location of the logging setting), was not helpful to you. May I suggest you look up the man pages for sshd_config. –  schroeder Jun 10 at 22:58
1  
You have to set the LogLevel directive to DEBUG in order to see that a SCP client connects, in my case this would be Sep 7 09:56:27 hostname sshd[22454]: debug1: Client protocol version 2.0; client software version WinSCP_release_5.0.6. But keep in mind, that /var/log/auth.log (on Debian) is going to grow. –  Ian Sep 7 at 7:57

SCP uses SSH connections to transfer files, so SCP logins should appear in the same logs alongside SSH logins. From the man pages:

scp copies files between hosts on a network. It uses ssh(1) for data transfer, and uses the same authentication and provides the same security as ssh(1).

share|improve this answer
    
I know it uses SSH and I thought logs would also go to the same place, but it actually doesn't show up in /var/log/secure nor /var/log/messages. The only evidence of SCP is when I have SELinux and auditd running... in which case it gets logged in /var/log/audit/audit.log. –  JJC May 9 '12 at 11:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.