I know login failures are logged in /var/log/auth.log

is there a way to log the login of users in this log
say something like

Jan 15 10:59:00 MyServer sshd[91869]: User bates authenticated from  
172.18.1.139
Jan 15 10:59:00 MyServer sshd[91869]: User bates Disconnected from  
172.18.1.139

================================
=== Richard Bates
=== TELEHOUSE America
================================


_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]

The normal system lastlog, accessed via last(1), does this fairly well.  As 
you notch up the level of logging on sshd, it should also be able to do that. 
However, I tend to use audit for the above type of functionality, as the 
results are more parseable using tools like auditreduce.  There's a handbook 
chapter on how to configure and use audit, should you be looking for something 
a bit more on that scale of things.

Robert N M Watson
Computer Laboratory
University of Cambridge
_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]

Ok,
	I setup a test server with
    	FreeBSd 6.2 installed
	Compiled the kernel to include auditd
	SAMBA3, NetAtalk, and SSH enabled

Audit seems to log the ssh connections,
but doesn't log the smb/cifs netatalk connections.
I'd also like to monitor MySQl connections.


Is there a way to do this?
I went through the audit section of the handbook,
but there is nothing specific.

Thanks


_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]

type in the terminal: 
last

display who login.

john






      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping
_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]

Hello, login successes are also logged in /var/log/auth.log - if you just want
to see the successful ssh logins, then do:

# cat /var/log/auth.log | grep -e "ssh.*Accept"

If you want to see a list of currently logged in users, then do:

# who

Cheers, Tim.


      ____________________________________________________________________________________
Looking for last minute shopping deals?  
Find them fast with Yahoo! Search.  http://tools.search.yahoo.com/newsearch/category.php?category=shopping
_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]

You can bump the debugging level in sshd(8).  Read sshd_config(5) man
page, and/or check out the debugging options available via PAM

~BAS


-- 
Brian A. Seklecki <bseklecki@collaborativefusion.com>
Collaborative Fusion, Inc.




IMPORTANT: This message contains confidential information and is intended only for the individual named. If the reader of this message is not an intended recipient (or the individual responsible for the delivery of this message to an intended recipient), please be advised that any re-use, dissemination, distribution or copying of this message is prohibited.  Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.


_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@freebsd.org"
[ message continues ]