Command last does not show logins through sFTP, is there something similar or any logs?

Question

When I run last I get something like:

user    pts/0        user.domain.provider Sat Feb 25 11:44   still logged in 
user    pts/0        user.domain.provider Thu Feb 23 16:38 - 16:39  (00:00)
...

But if I connect to the server with sFTP, this won't show up in this list. Are there any other logs or a different command?

which package you have used to configure sftp? – Mughil Feb 25 '12 at 11:02 — Mughil, Feb 25 '12 at 11:02
Hm... I don't really get your question. I use OpenSSH. – lumbric Feb 25 '12 at 11:18 — lumbric, Feb 25 '12 at 11:18

score 4 · Accepted Answer · answered Mar 01 '12 at 15:13

4

The default configuration of syslogd sends all log messages related to authentication to /var/log/auth.log, which will include openssh-server's log messages.

answered Mar 01 '12 at 15:13

geirha

46,101

score 3 · Answer 2 · edited Apr 13 '17 at 12:37

3

The last commands reads from /var/log/wtmp and its bad cousin /var/log/btmp, which according to man (man wtmp) are the login records.

Not all processes use this facility, so there may be other users logged to the system.

In the sftp case, I think that sshd does not consider scp or sftp as interactive sessions.

This was also discussed at https://unix.stackexchange.com/questions/20070/user-logged-in-by-sftp-does-not-show-up-in-w .

edited Apr 13 '17 at 12:37

Community

1

answered Feb 25 '12 at 14:31

jjmontes

353

Your answer and the Q&A you linked explain some details, but unfortunately don't solve my question. scp/sftp is not considered as interactive session, so there is no entry in /var/log/btmp or /var/log/wtmp. But if I want to check if a user is connected through sftp, I still don't know how to enable logging or where to find the logs. – lumbric Feb 26 '12 at 12:04
@lumbric check /var/log/auth.log – geirha Mar 01 '12 at 11:25
@geirha Oh wow, that was easy! If you convert it to an answer, I can award your answer for the bounty. – lumbric Mar 01 '12 at 14:27

score 3 · Answer 3 · answered Nov 04 '21 at 11:22

Add pam_lastlog.so module at the beginning of session section in /etc/pam.d/sshd file as shown below.

# vi /etc/pam.d/sshd 
<snip..>
session    required     pam_lastlog.so
session    required     pam_selinux.so close
session    required     pam_loginuid.so
<snip..>

Ensure the option UsePAM is enabled in /etc/ssh/sshd_config. If not, make the changes and restart sshd service.

# vi /etc/ssh/sshd_config 
<snip..>
#UsePAM no
UsePAM yes
<snip..>
service sshd restart

This should be the accepted answer. – drjeep Dec 07 '23 at 07:29 — drjeep, Dec 07 '23 at 07:29

Command last does not show logins through sFTP, is there something similar or any logs?

3 Answers3

service sshd restart