9

On Linux systems, /var/log/secure (or similar, depending on distro) shows all SSH login activity. Is there a similar log for SCP? If not, what's a good approach to enabling logging of scp activity on my servers? Is it SELinux through /var/log/audit/audit.log?

6

You need to adjust your sshd logging level to DEBUG in order to see scp client connections.

Look at the /etc/ssh/sshd_config for the "LogLevel" directive.

LogLevel DEBUG

Or the scp -o LogLevel for testing.

  • 2
    adjust the LogLevel directive to what? Excuse me for saying so, but without this information your answer is pretty much useless. If you know the answer, why don't you say LogLevel=foo ? – Martin Vegter Jun 10 '14 at 22:20
  • @MartinVegter I didn't make a specific setting suggestion because the OP didn't specify what logging level they were after. I'm sorry that my otherwise correct answer according to the OP (the location of the logging setting), was not helpful to you. May I suggest you look up the man pages for sshd_config. – schroeder Jun 10 '14 at 22:58
  • 2
    You have to set the LogLevel directive to DEBUG in order to see that a SCP client connects, in my case this would be Sep 7 09:56:27 hostname sshd[22454]: debug1: Client protocol version 2.0; client software version WinSCP_release_5.0.6. But keep in mind, that /var/log/auth.log (on Debian) is going to grow. – JohnnyFromBF Sep 7 '14 at 7:57
1

SCP uses SSH connections to transfer files, so SCP logins should appear in the same logs alongside SSH logins. From the man pages:

scp copies files between hosts on a network. It uses ssh(1) for data transfer, and uses the same authentication and provides the same security as ssh(1).

  • 1
    I know it uses SSH and I thought logs would also go to the same place, but it actually doesn't show up in /var/log/secure nor /var/log/messages. The only evidence of SCP is when I have SELinux and auditd running... in which case it gets logged in /var/log/audit/audit.log. – JJC May 9 '12 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.