Bug 19966 - sshd uses AUTH, not AUTHPRIV, for syslog entries
sshd uses AUTH, not AUTHPRIV, for syslog entries
Product: Red Hat Linux
Classification: Retired
Component: openssh (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Nalin Dahyabhai
Depends On:
  Show dependency treegraph
Reported: 2000-10-28 16:22 EDT by Jeff Norden
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2000-10-28 16:22:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jeff Norden 2000-10-28 16:22:45 EDT
sshd sends its syslog messages using the AUTH facility instead of
AUTHPRIV.  (According to the syslog(3) man page, the use of AUTH is
supposed to be deprecated.)  The result is that sshd messages go into
/var/log/messages and not /var/log/secure.  Since redhat leaves both these
log files readable only by root, the problem is not one of privacy. 
Rather, it is good practice to periodically scan /var/log/secure for
possible breaking attempts, etc,  (it is usually much shorter than
messages).  Not having any ssh entries there is a bad idea, imho.

A simple and immediate fix is to change the entry in /etc/syslog.conf  for
/var/log/secure from

 authpriv.*			/var/log/secure


 auth.*;authpriv.*                        /var/log/secure

sshd messages then go into both the messages and secure logs, but that's
ok.  I think that the above change to syslog.conf  is a good idea anyway,
even once sshd's logging gets fixed.
Comment 1 Nalin Dahyabhai 2000-10-30 15:51:39 EST
This will be fixed in openssh-2.2.0p1-8 and later.  Thanks!

Note You need to log in before you can comment on or make changes to this bug.