OpenSSH logging with Chroot Directory and SFTP Clients on CentOS

The following is adapted from for CentOS as I have tested it on a CentOS VM (Xen x86_64 CentOS release 6.2 (Final)).

Make syslog available in the chroot

Create a dev directory in each user’s chrooted directory:

Configure rsyslog to probe the new logging source

Put the following contents in /etc/rsyslog.conf :

Configure openssh for logging

Change /etc/ssh/sshd_config. The Subsystem sftp line will now read (ps I use INFO instead of VERBOSE as I tested both and they seem to look the same in the log file) :

Create a Match section (assuming username1/username2 are members of the sftponly group in /etc/group).

“Because of a limitation bug in OpenSSH, the ForceCommand line cannot be used with logging parameters on versions earlier than 5.2. But omitting the ForceCommand directive implicitely provides the user shell access in the chrooted directory if he has upload privileges. Therefore, this is in my view a security risk, and that is why I would say that enabling logging in this configuration requires OpenSSH 5.2 or later.”

Note: Tried to redirect sftp logging per the above referred article but it did not seem to work in CentOS, everything is logged to /var/log/secure which, in my case, is just fine so I did not research it any further. On the Debian side one user commented that the dev/log’s were not automatically created but this is not the case in CentOS, just add the entry to the /etc/rsyslog.conf file as above and do a service rsyslog restart and it works!

Any comments are welcome.

Ariix Launches New Product – BioPro Q – The first of many!

Ariix has launched BioPro Q! The first of many new and innovative products which will stem from the Ariix Opportunity and Leaders. BioPro Q support a healthy heart, immune system, and cellular energy. It sports a proprietary (and very expensive) form of CoQ 10 in concert with other ingredients.

Please listen to the Product Announcement here:

As usual if you are interested in trying the Ariix Products or wish to join our Marketing Group follow up here:

Place your Ariix Order Now!
Place your Ariix Order Now!