Home / server / Questions / 772053
In Process
HSchmale
Asked: 2016-04-22 10:42:22 +0800 CST

LDAP Remote Login Logs

  • 772

How would I log who authenticated against my ldap system on Linux in my lab? I have a lab with several workstations, and one server running openldap. I would like to have similar functionality as with the last command with who, when, and where. The server and workstations all run scientific Linux.

linux logging openldap pam-ldap

1 Answers

  1. You need to increase the logging level in your OpenLDAP instance. I believe the one you're looking for is 256. http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config

    For OLC, create a file with the following contents:

    dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats

    Then:

    ldapmodify -H ldapi:// -Y EXTERNAL -f <file>.ldif

    You'll start seeing logins show up in /var/log/syslog To get something in a 'last'-type format, you'll have to add some additional intelligence/logic to parse the syslog.

    Edit: Changed olcLogLevel specifier from '256' to 'stats' as suggested by 84104. Easier to understand.

    • 1