1

Is it possible to log the sftp logged in informations (Who accessed, when and from where )

Like which sftp user have logged on to the file server , This may also contain information such as ip address of the user.

The log may also give info such as directories accessed, and at last the commands executed.

I do have a dedicated centos server, of which root access is shared. So it is very important for me to track it.

If there is already a log file, may i know where on centos i can find it.

Thanks

echoashu
  • 115
  • 1
  • 7
  • You are making a big confusion. SFTP works via SSH, it cannot be handled by vsftp. Either you use FTP or FTPS, or you are connecting to SFTP via the SSH protocol. – Florin Asăvoaie Aug 27 '14 at 15:11

2 Answers2

2

SFTP as already mentioned works over ssh(port 22). So it's actual ssh users and you have to check corresponding logs.

It should be log: /var/log/secure if it's not rewritten by your actual rsyslog configuration.

Navern
  • 1,619
  • 1
  • 10
  • 14
  • Thanks naveen, That helped and i found the ip and timestamp. However is there any file which do logs the commands run by the logged in user ? thanks – echoashu Aug 27 '14 at 16:02
  • Actually there are no such file. You can log actions of user with Snoopy or auditd(configured in a right way). In security file you have only commands which were run with "sudo". That is. – Navern Aug 27 '14 at 17:33
0

Easiest way to get that info is to type: last

arober11
  • 426
  • 3
  • 7