This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: Enable logging remote ssh contacts
Cyrille Lefevre wrote:
>
>
> Le 27/04/2011 20:49, Fokke Nauta a Ãcrit :
> Hi,
>
>> I don't have any ll in the shell. Not recognized.
>> So I can't see the
>> I have syslog-ng running. Should I replace that by autossh?
>
> syslogd must be started before sshd... does it ?
>
> let's try configuring both services differently :
>
> # backup the actual configuration
> cygrunsrv -VQ syslogd > syslogd.cfg
> cygrunsrv -VQ sshd > sshd.cfg
>
> # stop the services
> cygrunsrv -E syslogd
> cygrunsrv -E sshd
>
> # remove the services
> cygrunsrv -R syslogd
> cygrunsrv -R sshd
>
> # reconfigure the services using the .cfg parameters if different
>
> # -y tcpip may be added but in this case, sshd should depend on
> # syslogd sshd (see the alternative below)
> cygrunsrv -I syslogd -p /usr/sbin/syslogd \
> -d "CYGWIN syslog daemon" -u LocalSystem -w ''
>
> # since tcpip doesn't start too early, syslogd has the time
> # to start before sshd does...
> cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
> -d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
> -y tcpip -e "CYGWIN=tty" # ntsec if XP, tty isn't necessary.
>
> # alternative, don't touch the syslogd service but provide it
> # as an sshd depedency...
> cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
> -d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
> -y tcpip -y syslogd -e "CYGWIN=tty" # ntsec if XP, tty isn't necessary.
>
> # start the services
> cygrunsrv -S syslogd
> cygrunsrv -S sshd
>
> although, permission check (under vista at least, don't know under XP)
>
> somebody@somewhere /var/log
> v2$ ls -ld . messages
> drwxrwxrwx+ 1 somebody None 0 Mar 31 00:38 .
> -rw-rw-r--+ 1 SYSTEM root 3495748 Apr 3 15:26 messages
> ----------^ note the + here => acl
>
> somebody@somewhere /var/log
> v2$ getfacl . messages
> # file: .
> # owner: somebody
> # group: None
> user::rwx
> group::rwx
> group:root:rwx
> group:SYSTEM:rwx
> mask:rwx
> other:rwx
> default:user::rwx
> default:group::rwx
> default:group:root:rwx
> default:group:SYSTEM:rwx
> default:group:Utilisateurs:r-x
> default:mask:rwx
> default:other:rwx
>
> # file: messages
> # owner: SYSTEM
> # group: root
> user::rw-
> group::rw-
> group:Utilisateurs:r-x
> mask:rwx
> other:r--
>
> at last, I prefer the VERBOSE log level than the info one :
>
> somebody@somewhere /var/log
> v2$ grep Level /etc/sshd_config
> LogLevel VERBOSE
>
>
> Regards,
>
> Cyrille Lefevre
>
>
Hi Cyrille,
Thanks for your help and explanation.
For a beginning: "syslogd must be started before sshd... does it ?"
It does. I can read the file /var/log/messages from the Cygwin shell and it
gets filled with data.
Hence the reason I did not follow your instructions as I thought it was
working allright.
I was not able to open in from within Windows, so installed cron and copy it
every 10 minutes to a different location. I am since then able to open that
new file from Windows.
Problem: The action of copying also creates an entry in /var/log/messages.
So that file is full of these entries.
What is the difference between LogLevel INFO and LogLevel VERBOSE in
/etc/sshd-config?
My properties of /var/log/messages (and here lies the problem that the file
is not accessable from withing Windows):
ls -ld messages
-rw------- 1 SYSTEM root 47648 Apr 28 14:09 messages
getfacl messages
# file: messages
# owner: SYSTEM
# group: root
user::rw-
group::---
mask:rwx
other:---
Should I use chmod on /var/log/messages?
Regards,
Fokke
--
View this message in context: http://old.nabble.com/Enable-logging-remote-ssh-contacts-tp31478200p31495952.html
Sent from the Cygwin list mailing list archive at Nabble.com.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple