2

I want to know who is accessing my server at any point in time and see logs from the past, however it is behind an SSH tunnel. How can I do this?

EDIT: See tags, running debian on both machines. SSHD is my SSH server.

EDIT: I already know how to List all connected SSH sessions? but I don't know which if any apply to ssh tunnels. They all seem to refer to PTS or TTY and I don't think SSH tunnels are like that although I may be wrong.

Samuel Philipp
  • 315
Jachdich
  • 175

1 Answers1

4

All the information you are looking for is available from the standard security logging/journaling service, which is included with systemd services.

Look into /var/log/auth.log in Debian installation or /var/log/secure in Red-Hat installation , if its is not there you might wish to install and activate the journaling service.

Learn to dig into the journal with journalctl command.

Learn more about journald service.

Good luck with your dig.

Dudi Boy
  • 549
  • 3
  • 9
  • Thank you for the answer! /var/log/secure indeed does not exist however I shall do some research when I can. – Jachdich May 31 '19 at 20:45