Extra OpenSSH logging for tracing SSH connections and tunnels
Zoltan Fridrich via openssh-unix-dev <[email protected]> Fri, 24 Apr 2026 16:07:01 +0200
| Newsgroups | gmane.network.openssh.devel |
|---|---|
| Message-ID | <CAEtiQY=tEpGW5K0se5VWSF4LBCspZDk9vs52OPcbu3Ay=mRm7g@mail.gmail.com> |
Hello I have a use-case where I need to be able to trace SSH connections and tunnels for traceability and security compliance purposes. More specifically, I need to be able to: - log every outgoing SSH connection on the client side including user ID and command details - log every SSH tunnel on the server side including source, target, ports and user ID Would such extra logging be acceptable for inclusion in the upstream code? I have attached a patch that implements this extra logging. Regards, Zoltan _______________________________________________ openssh-unix-dev mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
openssh-extra-logs.patch
(text/x-patch, 1.4 KB)
diff --git a/serverloop.c b/serverloop.c
index 8e63480ec..22eadbb9f 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -439,6 +439,9 @@ server_request_direct_tcpip(struct ssh *ssh, int *reason, const char **errmsg)
goto out;
}
+ logit("Tunnel: %s:%d -> %s:%d UID(%d)",
+ originator, originator_port, target, target_port, getuid());
+
debug_f("originator %s port %u, target %s port %u",
originator, originator_port, target, target_port);
diff --git a/ssh.c b/ssh.c
index 531f28eb2..2503595da 100644
--- a/ssh.c
+++ b/ssh.c
@@ -60,6 +60,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <syslog.h>
#include <unistd.h>
#include <limits.h>
#include <locale.h>
@@ -162,6 +163,24 @@ static int forward_confirms_pending = -1;
extern int muxserver_sock;
extern u_int muxclient_command;
+static void
+log_ssh_call(int ac, char **av)
+{
+ int i;
+ const size_t MSG_LEN = 400;
+ char msg[MSG_LEN], *p = msg;
+
+ for (i = 0; i < ac; i++) {
+ p = stpncpy(p, av[i], MSG_LEN - (p - msg));
+ p = stpncpy(p, " ", MSG_LEN - (p - msg));
+ }
+ msg[p - msg - 1] = '\0';
+
+ openlog("ssh", LOG_PID | LOG_NDELAY, LOG_AUTH);
+ syslog(LOG_NOTICE, "UID=%d EUID=%d %s", getuid(), geteuid(), msg);
+ closelog();
+}
+
/* Prints a help message to the user. This function never returns. */
static void
@@ -677,6 +696,8 @@ main(int ac, char **av)
av = saved_av;
#endif
+ log_ssh_call(ac, av);
+
seed_rng();
/* Get user data. */