Home / server / Questions / 313334
Accepted
Quintin Par
Asked: 2011-09-21 00:02:53 +0800 CST

Ssh log monitor

  • 772

Are there any tools to monitor ssh logs at /var/log/secure and report activity?

I am looking for some tools that will proactively tell me about user actions and highlight malicious activity.
I don’t want write a cron based log tool since I am unaware of the umpteen edge cases.

FYI, I use CentOS

logging monitoring ssh malicious

3 Answers

  1. Also take a look at OSSEC. The default rules can send you an email when:

    • an user is created:

         Rule: 5902 fired (level 8) -> "New user added to the system" Portion
   of the log(s):

   Sep 20 15:29:50 SVR015-493 useradd[22825]: new user: name=x, UID=507,
   GID=512, home=y, shell=/sbin/nologin

    • Multiple failed login attempts 

         Rule: 11210 fired (level 10) -> "Multiple failed login attempts." 

   Aug 23 18:47:07 x proftpd[22934]:
   y(::ffff:183.106.7.2[::ffff:183.106.7.2]) - Maximum login attempts
   (3) exceeded, connection refused

    • First time user executed sudo

         Rule: 5403 fired (level 4) -> "First time user executed sudo."
   Portion of the log(s):

   Jul  2 11:55:14 x sudo:   y : TTY=pts/3 ;
PWD=/home/y ; USER=root ; COMMAND=/bin/su -

    • Illegal root login

         Rule: 2504 fired (level 9) -> "Illegal root login. "
   Portion of the log(s):

   Jul  2 11:54:39 SVR4149 sshd[13558]: ROOT LOGIN REFUSED FROM x.x.x.x
    • ...
    • 4
  2. Best Answer

    logwatch will keep an eye out and send you daily alerts about failed logins, etc, and fail2ban will monitor connection attempts and block an IP after n-failed logins within n-seconds. there are more options here than would be wise to shake a stick at, though.

    • 3

  3. The default configuration of logwatch should do that on CentOS, with a cron.daily entry to send an email that will contain an SSHD section summarizing failed and successful logins (as well as summarizing pam_unix output scanned from /var/log/secure showing authentication failures, invalid users, etc).

    • 1