[arch-general] Missing auth.log
Hi, One of our systems, running ARCH Linux, was compromised (a non-privileged account, fortunately). But, we could not find /var/log/auth.log or similar for investigation. Does the journal keep track of login attempts? It seems that ARCH does not run [r]syslogd. Best regards, Maxe kaasen@nuts-edu.no
On Fri, Nov 16, 2018 at 01:43:17AM +0100, Maxe wrote:
Hi,
One of our systems, running ARCH Linux, was compromised (a non-privileged account, fortunately). But, we could not find /var/log/auth.log or similar for investigation. Does the journal keep track of login attempts? It seems that ARCH does not run [r]syslogd.
If you want authpriv messages, then run "journalctl SYSLOG_FACILITY=10". See https://en.wikipedia.org/wiki/Syslog#Facility for mapping between numerical and mnemonic facility IDs. Oh, and do install syslog-ng :) Cheers, -- Leonid Isaev
On 16/11/2018 00:43, Maxe wrote:
Hi,
One of our systems, running ARCH Linux, was compromised (a non-privileged account, fortunately). But, we could not find /var/log/auth.log or similar for investigation. Does the journal keep track of login attempts?
Yes. journalctl allows access to the logs from sshd, `journalctl -u sshd` Also, https://classic.startpage.com/do/search?q=arch+auth.log points to: https://wiki.archlinux.org/index.php/systemd#Facility which says:
* Show auth.log equivalent by filtering on syslog facility:
# journalctl SYSLOG_FACILITY=10
which is worth a go.
Hi, On Thu, 15 Nov 2018, Leonid Isaev via arch-general wrote:
If you want authpriv messages, then run "journalctl SYSLOG_FACILITY=10". See https://en.wikipedia.org/wiki/Syslog#Facility for mapping between numerical and mnemonic facility IDs. Oh, and do install syslog-ng :)
On Fri, 16 Nov 2018, Jonathon Fernyhough wrote:
Yes.
journalctl allows access to the logs from sshd, `journalctl -u sshd`
Thanks for your suggestions! They seem to work nicely. Best regards, Maxe
participants (3)
-
Jonathon Fernyhough
-
Leonid Isaev
-
Maxe