Re: [Proftpd-user] mod_sftp - logging remote IP address on authentication?

> Would it be possible to log Kex & Encryption & Mac algos to the logs, too?
>
> I have a server with "legacy" ciphers still enabled, and it's difficult 
> to identify which users are still on old technology stacks - and we 
> can't just turn them off and tell our users to deal with it - so I want 
> to identify our offenders and contact them directly.

The SSH algorithms selected for a session are logged, in the SFTPLog file, over a series of messages:

  Session key exchange: ...
  Session server hostkey: ...
  Session client-to-server encryption: ...
  Session server-to-client encryption: ...
  Session client-to-server MAC: ...
  Session server-to-client MAC: ...
  Session client-to-server compression: ...
  Session server-to-client compression: ...
  
Adding these algorithms as fields on every subsequent log message would be redundant, and increase the size of each log message unnecessarily.

Usually such requests for information/details being logged come down to _which_ logs contain the information, and when.  There's no one place that works for everyone's desires/needs.  Sometimes what is considered _crucial_ log info for one site, in one log, is considered trivial/unnecessary to another site, using that same log.

Often there is a lot of _state_ information, contained across multiple logs and multiple messages, that given sites want.  Post-processing of ProFTPD-generated log files, according to the site-specific needs, is usually the best way to obtain that state.

Cheers,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html