Extra OpenSSH logging for tracing SSH connections and tunnels

Zoltan Fridrich via openssh-unix-dev <[email protected]> Fri, 24 Apr 2026 16:07:01 +0200
Newsgroups gmane.network.openssh.devel
Message-ID <CAEtiQY=tEpGW5K0se5VWSF4LBCspZDk9vs52OPcbu3Ay=mRm7g@mail.gmail.com>
Hello

I have a use-case where I need to be able to trace SSH connections and
tunnels for traceability and security compliance purposes.
More specifically, I need to be able to:
- log every outgoing SSH connection on the client side including user ID
and command details
- log every SSH tunnel on the server side including source, target, ports
and user ID

Would such extra logging be acceptable for inclusion in the upstream code?

I have attached a patch that implements this extra logging.

Regards,
Zoltan

_______________________________________________
openssh-unix-dev mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
openssh-extra-logs.patch (text/x-patch, 1.4 KB)
diff --git a/serverloop.c b/serverloop.c
index 8e63480ec..22eadbb9f 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -439,6 +439,9 @@ server_request_direct_tcpip(struct ssh *ssh, int *reason, const char **errmsg)
 		goto out;
 	}
 
+	logit("Tunnel: %s:%d -> %s:%d UID(%d)",
+	    originator, originator_port, target, target_port, getuid());
+
 	debug_f("originator %s port %u, target %s port %u",
 	    originator, originator_port, target, target_port);
 
diff --git a/ssh.c b/ssh.c
index 531f28eb2..2503595da 100644
--- a/ssh.c
+++ b/ssh.c
@@ -60,6 +60,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <syslog.h>
 #include <unistd.h>
 #include <limits.h>
 #include <locale.h>
@@ -162,6 +163,24 @@ static int forward_confirms_pending = -1;
 extern int muxserver_sock;
 extern u_int muxclient_command;
 
+static void
+log_ssh_call(int ac, char **av)
+{
+	int i;
+	const size_t MSG_LEN = 400;
+	char msg[MSG_LEN], *p = msg;
+
+	for (i = 0; i < ac; i++) {
+		p = stpncpy(p, av[i], MSG_LEN - (p - msg));
+		p = stpncpy(p, " ", MSG_LEN - (p - msg));
+	}
+	msg[p - msg - 1] = '\0';
+
+	openlog("ssh", LOG_PID | LOG_NDELAY, LOG_AUTH);
+	syslog(LOG_NOTICE, "UID=%d EUID=%d %s", getuid(), geteuid(), msg);
+	closelog();
+}
+
 /* Prints a help message to the user.  This function never returns. */
 
 static void
@@ -677,6 +696,8 @@ main(int ac, char **av)
 	av = saved_av;
 #endif
 
+	log_ssh_call(ac, av);
+
 	seed_rng();
 
 	/* Get user data. */