Re: [Proftpd-user] condensed logging for sftp security details
Chris Young <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <CABr7rqODvrAkJqHBrJfq+1KiRVi_Q89XnowSabfM_yuDwW4udA@mail.gmail.com> |
thanks, I figured as much. I'll just have to parse these logs. /grep out the session id for rows matching ciphers I wish to deprecate/re-grep the logs for matching users and necessary data On Fri, Jan 8, 2021 at 5:59 AM Matus UHLAR - fantomas <[email protected]> wrote: > On 04.01.21 12:59, Chris Young wrote: > >I'm able to pull these logs from the mod_sftp logs > >But is it possible to condense these into a single line > >I see logFormat for the proftpd logs, but I'm not sure how any of that > >would transfer or be applicable to the mod_sftp logs > > I'm afraid these are not applicable. These are debug logs. > > >2021-01-04 18:51:29,490 mod_sftp/1.0.0[17388]: received client version > >'SSH-2.0-PuTTY_Release_0.69' > >2021-01-04 18:51:29,490 mod_sftp/1.0.0[17388]: handling connection from > >SSH2 client 'PuTTY_Release_0.69' > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session key exchange: > >ecdh-sha2-nistp256 > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session server hostkey: > >ssh-rsa > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session client-to-server > >encryption: aes256-ctr > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session server-to-client > >encryption: aes256-ctr > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session client-to-server > >MAC: hmac-sha2-256 > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session server-to-client > >MAC: hmac-sha2-256 > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session client-to-server > >compression: none > >2021-01-04 18:51:29,491 mod_sftp/1.0.0[17388]: + Session server-to-client > >compression: none > >2021-01-04 18:51:29,836 mod_sftp/1.0.0[17388]: user 'hostey' authenticated > >via 'password' method > > -- > Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/ > Warning: I wish NOT to receive e-mail advertising to this address. > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > Atheism is a non-prophet organization. > > > _______________________________________________ > ProFTPD Users List <[email protected]> > Unsubscribe problems? > http://www.proftpd.org/list-unsub.html > _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html